Robust Multivariate Time-Series Forecasting: Adversarial Attacks and Defense Mechanisms
Authors: Linbo Liu
Youngsuk Park
Trong Nghia Hoang
Hilaf Hasson
Luke Huan
Venue: ICLR 2023 poster (2023)
Keywords: Multivariate Timeseries Forecasting

Abstract: This work studies the threats of adversarial attack on multivariate probabilistic forecasting models and viable defense mechanisms. Our studies discover a new attack pattern that negatively impact the forecasting of a target time series via making strategic, sparse (imperceptible) modifications to the past observations of a small number of other time series. To mitigate the impact of such attack, we have developed two defense strategies. First, we extend a previously developed randomized smoothing technique in classification to multivariate forecasting scenarios. Second, we develop an adversarial training algorithm that learns to create adversarial examples and at the same time optimizes the forecasting model to improve its robustness against such adversarial simulation. Extensive experiments on real-world datasets confirm that our attack schemes are powerful and our defense algorithms are more effective compared with baseline defense mechanisms.


Published as a conference paper at ICLR 2023
ROBUST MULTIVARIATE TIME-SERIES FORECASTING: ADVERSARIAL ATTACKS AND DEFENSE MECHANISMS
Linbo Liu', Youngsuk Park', Trong Nghia Hoang², Hilaf Hasson' Jun Huan'
AWS AI Labs, *Washington State University, (linbol, pyoungsu, hashilaf, lukehuan) (emazon.com. trongnghia hoang wsu.edu
ABSTRACT
This work studies the threats of adversarial attack on multivariate probabilistic forecasting models and viable defense mechanisms. Our studies discover new attack pattern that negatively impact the forecasting of a target time series via making strategic, sparse (imperceptible) modifications to the past observations of a small number of other time series. To mitigate the impact of such attack, we have developed two defense strategies. First, we extend previously developed randomized smoothing technique in classification to multivariate forecasting sce- narios. Second, we develop an adversarial training algorithm that learns to create adversarial examples and at the same time optimizes the forecasting model to im- prove its robustness against such adversarial simulation. Extensive experiments on real-world datasets confirm that our attack schemes are powerful and our defense algorithms are more effective compared with baseline defense mechanisms.
INTRODUCTION
Understanding the robustness for time-series models has been long-standing issue with applica- tions across many disciplines such as climate change (Mudelsee, 2019), financial market analysis (Andersen et al., 2005; Hallac et al., 2017), down-stream decision systems in retail (Böse et al., 2017), resource planning for cloud computing (Park et al., 2019; 2020), and optimal control of ve- hicles (Kim et al., 2020). In particular, the notion of robustness defines how sensitive the model output when authentic data is (potentially) perturbed with noises. In practice, as observation data are often corrupted by measurement noises, is important to develop statistical forecasting models that are less sensitive to such noises (Brown, 1957; Brockwell & Davis, 2009; Taylor & Letham, 2018) more stable against outliers that might arise from such corruption (Connor et al., 1994; Gelper et al., 2010; Liu & Zhang, 2021; Wang & Tsay, 2021). However, these approaches have not considered the possibility of adversarial noises which are strategically created mislead the model rather than being sampled from known distribution.
As matter of fact, vulnerabilities against such adversarial noises have been previously pointed out (Szegedy et al., 2013; Goodfellow et al., 2014b) in classification. In practice, it has been shown that numan-imperceptible adversarial perturbation can alter classification outcomes of a deep learning (DL) model, revealing a severe threat to many safety-critical systems As such a risk is associated with the high capacity to fit complex data pattern of DL, we postulate that similar threats might also occur in forecasting where modern DL-based forecasting models (Rangapuram et al., 2018: 8: Salinas et al., 2020; Lim et al., 2020; Wang et al., 2019; Park et al., 2022) have become the dominant ap- proach. For example, to mislead the forecasting of particular stock, the adversaries might attempt to alter some features external to the stock's financial valuation to maximize the gap between predic- tions of its values on authentic and altered features. The feasibility of such an adversarial attack has been recently demonstrated with tweet messages (Xie et al., 2022) on text-based stock forecasting.
Motivated by these real scenarios, we propose investigate such adversarial threats on more practi- cal forecasting models whose predictions are based on more precise features, e.g. valuations of other stock indices. Intuitively, rather than releasing adverse information alter the sentiment about the target stock on social media, the adversaries can instead invest hence change the valuation adversely
*T. N. Hoang contributed this paper while working Amazon.

---

Published as a conference paper at ICLR 2023
for selected subset of stock indices (not including the target stock) which is arguably harder to detect. Interestingly, despite being seemingly plausible given the vast literature on adversarial at- tack for classification models, formulating such imperceptible attack under multivariate forecasting setup is not straightforward. This is due to several differences between forecasting and classification, particularly in terms of unique characteristic of time series, e.g., multi-step predictions, correlation over multiple time series, and probabilistic predictions.
These differences open up the question of how adversarial perturbations and robustness should be defined more properly in time series setting. Although there have been a few recent studies in this direction based on randomized smoothing (Yoon al., 2022), these approaches are all restricted to univariate forecasting where the attack has to make adverse alterations directly to the target time series. Thus, under the less studied scenario of multivariate dime-series forecasting setup, remains unclear whether the attack to target time series can be made instead via perturbing the other cor- related time series; and whether it is defensible against such adversarial threats. In particular, as illustrated above in the stock forecasting example, there are new regimes of sparse and indirect cross time series attack under multivariate time-series scenarios, which are more effective and realistic than the direct attack in univariate cases.
In order to understand whether such new regimes of attack exists and can be defended against, we raise three questions:
Indirect Attack. Can we mislead the prediction of some target time series via perturbations on the other time series?
2. Sparse Attack. Can such perturbations be sparse and non-deterministic to be less perceptible?
Robust Defense. Can we defend against those indirect and imperceptible attacks?
Here we summarize our technical contributions by answering the questions above:
Regarding indirect attack, we provide general framework of adversarial attack in multivariate time
series (see Section 3.1). Then, we devise a deterministic attack (see Section 3.2) to the state-of- the-art probabilistic multivariate forecasting model. The attack changes the model's prediction on the target time series via adversely perturbing a subset of other time series. This is achieved via formulating the perturbation as solution of an optimization task with packing constraints.
Regarding sparse attack, we develop non-deterministic attack (see Section 3.3) that adversely perturbs a stochastic subset time series related to the target time series, which makes the attack less perceptible. This is achieved via a stochastic and continuous relaxation of the above packing constraint which are shown (see Section 5) to be more effective than the deterministic attack in certain cases. Moreover, unlike deterministic attack, its differentiability makes it suitable to be directly integrated as part of diffcrentiable defense mechanism that can be optimized via gradient descent in end-to-end fashion, as discussed later in Section 4.2.
Regarding robust defense, we propose two defense mechanisms. First, we adapt randomized smoothing the multivariate forecasting setup with robust certificate. Second, devise defense mechanism (see Section 4.2) via solving a mini-max optimization task which minimizes the maximum expected damage caused by the probabilistic attack that continually updates the genera- tion of its adverse perturbations in response to the model updates. Their effectiveness are demon- strated across extensive experiments in Section 5.
Furthermore, our experiments in Section 5.3 demonstrate that attacks designed for univariate cases cannot be reused an effective attack to multivariate forecasting models, which high- lights the importance and novelty of our studies. The code to reproduce our experiments results can be found ht http:: http://tww....o./aaa////////////
2 RELATED WORK
Deep Forecasting Models. The recent decades have witnessed a tremendous progress in DNN- based forecasting models. Given the temporal dependency of time series data, RNN and CNN-based architectures have been proved a success for time series forecasting tasks, see Rangapuram et al. (2018); Lim et al. (2020); Wang et al. (2019); Salinas et al. (2020) and Oord al. (2016); Bai et al.
2

---

Published as a conference paper at ICLR 2023
prodictio
perpust
MITS
Indrestt ottnck
Torboaster
bargel nange
Figure 1: Illustration figure: an attacker misleads prediction of time series (TS) time 288 by indirectly attacking TS 5. Left plot is authentic (orange) and perturbed (blue) versions of TS 5; right plot is no-attack (orange) and under-attack (blue) predictions for TS 1. Ground truth (green) is also plotted for comparison. No alteration is made to TS but the prediction of TS at the attack time step (L = 288) is adversely altered in the under-attack (blue) setting, which
the prediction of TS significantly away from the ground truth.
(2018) respectively. To model the uncertainty, various probabilistic models have been proposed from distributional outputs (Salinas et al., 2020; de Bézenac et al., 2020; Rangapuram et al., 2018) to distribution- free quantile-based outputs (Park et al., 2022; Gasthaus et al., 2019; Kan et al., 2022). In multivariate cases, Salinas et al. (2019) generalized DeepAR (Salinas et al., 2020) to multivariate cases and adopted low-rank Gaussian copula process to tackle the high-dimenssonality challenge.
Ad veresarial Attack. Despite its success in various tasks, deep neural network is especially vulnera- ble to adversarial attacks (Szegedy et al., 2013) in the sense that even imperceptible adversarial noise can lead completely different prediction. In computer vision, many adversarial attack schemes have been proposed. See Goodfellow et al. (2014b); Madry et al. (2018) for attacking image clas- sifiers and Dai al. (2018) for attacking graph structured data. the field of time series, there is much less literature and even so, most existing studies on adversarial robustness of MTS models (Mode & Hoque, 2020; Harford et al., 2020) are restricted regression and classification settings. Alternatively, Yoon et al. (2022) studied both adversarial attacks to probabilistic forecasting models, which is only restricted to univariate settings.
Adversarial Robustness and Certification. Against adversarial attacks, an extensive body of work has been devoted to quantifying model robustness and defense mechanisms. For instance, Fast- Lin/Fast-Lip (Weng et al., 2018) recursively computes local Lipschitz constant of neural network; PROVEN (Weng et al., 2019) certifies robustness probabilistic approach. Recently, randomized smoothing has gained increasing popularity
enhance model robustness, which proposed by Cohen et al. (2019); ; et al. (2019) as a defense approach with certification guarantee. To the time series setting, Yoon al. (2022) adopted randomized smoothing technique univariate forecasting models and developed theory therein. However, we are not aware of any prior works on randomized smoothing for multivariate probabilistic models.
ADVERSARIAL ATTACK STRATEGIES
We provide generic framework of sparse and indirect adversarial attack under multivariate setting in Section 3.1. Then, deterministic one to this task is introduced next in Section 3.2, followed by stochastic attack derived Section 3.3.
Denote d-dimensional multivariate time series x, E Rd at time / with its observation of i-th time series Fy [x:],- We denote x {x, R and z (xy-1)-m E dxxr as recent T historical observations and next 7-step of the future values respectively. Then, probabilistic forecaster Po with parameterzation / takes history x to predict z, i.e., po(. x). We denote the set [d) (1, (I....,} d} and i-th time series as 6' ((5.):)(=1-
Notations.
3.1 FRAMEWORK ON SPARSE AND INDIRECT ADVERSARIAL. ATTACK
Following the notation convention of Dang-Nhu et al. (2020), given an adversarial prediction target fady and historical input to the forecaster po (zlxx). design perturbation matrix 8 such that
3

---

Published as a conference paper at ICLR 2023
the perturbed input ô disturbs statistic x(z) as close possible Cadv- That is, find such that the distance between [x(x+ and tadv is minimized. Here, x(z) and tady are any arbitrary function of interest adversarial target values with the same dimension. We focus on scenarios where the perturbed prediction far way from original prediction by properly choosing and Ladv 1002, the adversary's target is to design an attack that can increase the prediction by 100 times.
x() and fadv. For example, by choosing x(2
Thus, suppose the adversaries want to mislead the forecasting of time series in a subset I [d]. denoted as z². Let be a statistic function of interest that concerns only time series in I. i.e. (z) = x(z"). To make the attack less perceptible, we impose the following sparse and indirect constraints: First, perturbation cannot be direct to target time series in I and can be indirectly applied to a small subset of I = [d] \ I. In other words, we restrict 8 = and s(8) 8' * 0J| S к with sparsity level S d. Lastly, to avoid outlier detection, we also cap the energy of the attack such that the value of the perturbation at any coordinates is no more than a pre-defined threshold r7. To sum up, the sparse and indirect attack ô can be found via solving
Ki E I
{ F(O))
minimize SER
A
E [pp((lx+d) [(()
tadv
(3.1)
subject to
|18| max 77 s() K. 8 = 0,
where ||0]|max maxt,; [[ is the element-wise maximum norm. As such, small values of x and y imply a less perceptible attack. However, solving this is intractable due to the discrete cardinality constraint on s(5). To sidestep this, we develop two approximations in the subsequent sections which correspond to our deterministic and non-deterministic attack strategies.
3.2 DETERMINISTIC ATTACK
Here we present an approximated solution, inspired by the ideas in Croce & Hein (2019). We first get an intermediate solution 8 through projected gradient descent (PGD) until it converges,
8
II (b-aVoF(8)) (8))
(3.2)
B² (0.n)
where a 2 step size and II (0.r) is the projection onto the lo -nom ball with radius n, 7/ if [[,.]a] n else [ô.];- With this intermediate non-sparse 8, we retrieve for final sparse perturbation via solving
allowing simple element-wise clipping: (o.. (18.))) sign((8.):)
minimize 8ER
||5 - 8|1 subject to s(6) < K, 8 0.
(3.3)
It turns out (3.3) can be solved analytically. Given d, we compute the absolute perturbation added to each row i, p. Σ"= |(+] for i [d] I and sort them in descending order क: Px: 2 2 Psa
Finally, we construct the solution as with 8 8 i S λ else 0.
Remark. F(F(6) involves the computation of the gradient of expectation, which doesn't 't have a closed-form solution. To overcome this intractability, we adopt the re- re-parameterized sampling approach used in Dang-Nhu al. (2020) and Yoon et al. (2022).
3.3 PROBABILISTIC ATTACK
To make the attack even less perceptible, we further show in this section alternative approximation that results in a probabilistic sparse attack, which makes adverse alterations to a non-deterministic set of coordinates (i.c., time series and time steps). As shown in our experiment, this non-determinism appears to make the attack stronger and harder to detect.
To achieve this, we view the sparse attack vector as a random vector drawn from distribution with differentiable parameterization. The core challenge is how to configure such a distribution whose support is guaranteed be within the space of sparse vectors. To achieve this, propose sparse layer, a distributional output, of a normal standard and a Dirac density combination. The output of this layer satisfied relaxed sparse support condition (see Theorem 3.2).
4

---

Published as a conference paper at ICLR 2023
Algorithm Deterministic Adversarial Attack
input: pre-trained model (z x), observation x and other parameters:
statistic x(), adversarial target tadv, target set C [d]
attack energy 7,, sparse constraint K, PGD iterations n and step size a 2
output: perturbation matrix E IR 7xx s.t. ||6 | S 7, s(5) S K, 6²h = 0 1. initialize 6
n do for iteration 1, .
2. compute the expected loss F(8) using Eq. (3.1)
3. update 5 via PGD in Eq. (3.2)
end for
4. for i & I, compute p; = -i= [6
5. sort p; a descending order = (T..... Ra): Pr. 2 Pro 2 ... 2 Pma
6. set 5 5842
8 0 and 8 0. Return 8.
Sparse Layer. A sparse layer is defined as distributional output g(0]x; 3,7) of 8 having indepen- dent rows, such that its sample (probabilistic attack) ~ q(6 x;; 3, = II, (0( 3,7) satisfies sparse condition [[s( S x and 8 O. With 8 denoted as the i-th row (time series) of 8 and sparsity level K, each factor distribution (6 (6'('
xx: B.?) parameterized by and is defined as
qi( (8 xx
rs (7) of 8' xx + (1 (1-r:(1) D (
(3.4)
where r,(7) A 17 EE 7) / ( = I(ō' = -0) is the Dirac density, and (((6') x: (3) a Gaussian (( (x; B))
The combination weight ri())) denotes the probability mass of the event o' = O, which is parame- terized by y. Intuitively, this means the choice of {r:(7) {=]] controls the row sparsity of the random
matrix 8, which can be calibrated to enforce that [[(((O) [d) S We will show in Theorem 3.1 how
samples can be drawn from the combined density in (3.4).
Theorem 3.1. Let 8" d.l. x; x;3,7) and I[u;; S $ (r:(()))) Then, d' (5 x; B,7).
N(0, 1) for i= 1,...,d. Define 8² 8t
Here, gi (-1;; 7, is given in (3.4) and +-1 is the inverse cumulative of the standard normal distri- bution. We provide the proof in the appendix.
For implementation: Let gf( x; 3) be a distribution over dense vectors, e.g. N(u(3), ((()) and u; ~ N(0, for i E [d]. We can construct a binary mask m, = L[w; _ 4 (ri()),)) E [d]. where (7) is defined above. Next, for each E [d]. we draw 5 from o( x; B) and obtain & by 8' 8' m, where denotes the clement-wiss multiplication. Finally, set 5 0.
Theorem 3.2 proves that sampled from (3.4) would meet the constraint {[s S к. Put together,
Theorem 3.1 and Theorem 3.2 enable differentiable optimization of a sparse attack as desired.
Theorem 3.2. Let 8 4(- xx 8, 7) Then, [[s())) <
Remark. Note that we can also obtain a direct sparse constraint on s()) by applying Theorem 3.2 to smaller quantity es for (0, 1). Then, by the Markov inequality, with probability at least c, we have (0) < {[s(o))/c = ck/c = k. We provide the proof of Theorem 3.2 in Appendix C.
Optimizing Sparse Layer. The differentiable parameterization of the above sparse layer can there- fore be optimized for maximum attack impact via minimizing the expected distance between the attacked statistic and adversarial target:
[x(x)] tadv 1
min (8, B,y
R2 Es~((1x))))) E
(3.5)
This attack probabilistic two ways. First, the magnitude of the perturbation 8 a random vari- able from distribution q(- x). Second, the non-zero components of the mask depend the random Gaussian samples, which brings another degree of non-determinism into the design, making the attack less perceptible and harder to detect. See Algorithm 4 in Appendix A for the implementation.
5

---

Published as a conference paper at ICLR 2023
Remark. There three important advantages of the above probabilistic sparse attack. First, by viewing the attack vector as random variable drawn from a learnable distribution instead of fixed parameter to be optimized, proached previous literature (Croce & Hein, 2019). Second, our approach introduces multiple degree of non-determinism to the attack vector, apparently making more stealth and powerful (see Section 5), Last, unlike the deterministic attack which has two separate, decoupled approximation stages that cannot be optimized end-to-end due the non-convex and non-differentiable constraint in (3.1) the probabilistic attack model is entirely differentiable. Therefore, it can be directly inte- grated as part of differentiable defense mechanism that can be optimized via gradient descent in an end-to-end fashion see Section 4.2 for more details. Again, we adopt re-parameterizaed sampling approach to compute the gradient of the expectation Eq. (3.5).
able to avoid solving the NP-hard problem (3.1) usually ap-
DEFENSE MECHANISMS AGAINST ADVERSARIAL ATTACKS
The adversarial attack on probabilistic forecasting models was investigated under the univariate time series setting (Dang-Nhu et al., 2020; Yoon al., 2022). Beyond basic data augmentation (Wen et al., 2020), develop more effective defense mechanism to enhance model robustness via randomized smoothing (in Section 4.1) and mini-max defense using sparse layer (in Section 4.2).
4.1 RANDOMIZED SMOOTHING DEFENSE
Randomized smoothing (RS) (Cohen et al., 2019) is a post-training defense technique. Having never been considered to multivariate setting to the best our knowledge, we apply RS to our multivariate random vector =(x) distributed by po x). Let
forecasters =(x) (z x) which maps P=(=(x) N r) denote the CDF of such random outcome vector where denotes the element-wise inequality, the RS version
(x( = Be 2(x + +c)
(4.1)
of 2xx with noise level a > 0 and E~ N(0, o² is a random vector whose CDF is defined as 21) [P= (2x (2(x++)==))
Pg. go (x) 3r
(4.2)
where we abuse the notation e ~ N(O, 2²1) to indicate the (scalar) entries of the matrix e are inde- pendently and identically distributed by N(O, o²). Computing the output of the smoothed forecaster (x(x) is intractable in general since the integration of 2(x + c) with N(0, cannot done ana- lytically. However, can still be approximated with arbitrarily high accuracy via MC sampling with a sufficiently large number of samples. Check Algorithm for a detailed implementation.
Algorithm 2 Randomized Smoothing
Algorithm 3 Mini-max Defense
input: forecaster 2xx) ~ (z|x) and:
input: dataset D of (x,2) pairs and parameters:
number of samples
sparse constraint x for q in Eq. (4.6)
noise level
number of optimization iterations n
input x
output: forecasting model =(x) ~ pa(z x).
output: 9a (x)
for 1, ... do
initialize 9- (x) 0
1. Fix f, minimize
Σ (x,2)= x,
for e = 1,2.... do
with respect to Φ see Eq. (4.5)
1. sample (e))),, N(0,02)
2. Fix Φ. maximize Σ(xx)) ey (0; x, 2, +)
2. (x) + (1()))((()))
with respect to see Eq. (4.6)
end for
end for
For the randomized smoothing version go of the base forecaster 2(x) ~ po(z|x), we establish a robustness guarantee certificate in the following theorem.
Theorem 4.1 (Robust Certificate). Given an input x, let (x) be defined in Eq. (4.1). Let G(r) =
P (ga (x) 3 r) and Gs(r) = 12,, (go (x + 8) 3 r). For any 8, we have
Vd
sup rERd
G(r) Go(T) s
(4.3)
a

---

Published as a conference paper at ICLR 2023
This shows that the difference between the CDFs of the smoothed forecaster authentic and per- turbed input, i.e. 9o (x) and go (x + 8), is guaranteed to be no more than O(1))) We defer the formal proof to Appendix C.
Remark. Different from Theorem 1 in Yoon et al. (2022) that only applies to univariate cases, our Theorem 4. provides more general robustness guarantee it's available for multivariate setting. Also, Theorem in Yoon et al. (2022) only holds for 5 -> O, but our Theorem 4.1 holds for any 5.
4.2 MINI-MAX DEFENSE
As discussed Section 3.3, the sparse layer is differentiable, which is suitable be directly inte- grated as part of differentiable defense mechanism that can be optimized via gradient descent in an end-to-end fashion. To fix the idea, with sparse layer q(- x; o) having parameters Φ = (3, 7) in Eq. (3.4), we propose to train the forecaster by minimizing the worst-case loss caused by g(- x: Φ):
min max
Σ [p(0;x, - xg():x,2,0)
(4.4)
(x22>D
Here f,(6; x, 2, 0) is a function of Φ conditioned (x while (0; 2, is a function of conditioned on (x, z, 6) as follows
_g(0)(;0)) xxd) E [ppter - [2]
f,(0xx,2,0)
(4.5)
2000
loog 12|x+) 1+xx+)6]
(4.6)
where the expectation is taken over ô ~ g(0) (10]2;;0 Φ) with @ given by Eq. (3.4), each pair (x, 2)
represents a training data point in our dataset with x x= (x1)==1 and z = (xT++)===
Solving Eq. (4.4) therefore means finding stable state where the model parameter is conditioned to perform best in the worst situation where the adversarial noises are also conditioned to generate the most impact even in the most benign scenario. This can be achieved by alternating between (1) minimizing -gg in Eq. (4.5) with respect to (3,7) and (2) maximizing lp in Eq. (4.6) with respect to 6. We call this defense mechanism a mini-max defense. We note that similar ideas have been previously exploited in deep generative models, such GAN (Goodfellow et al., 2014a) and WGAN (Arjovsky et al., 2017). See Algorithm 3 for a detailed description.
Unlike the sparse layer used in attack, the sparse layer used to simulate mock attack in defense strategy does not have access to the actual attack sparsity parameter x. or the set of target time series Z. Hence, need to set the sparsity к as tuning parameter and skip the last step of the sparse layer described in Section 3.3 where we set 8² O.
Remark.
5
EXPERIMENTS
We conduct numerical experiments to demonstrate the effectiveness of our proposed indirect sparse attack multivariate probabilistic forecasting models and compare various defense mechanisms.
5.1 EXPERIMENT SETUPS
Dataset. We include Traffic (Asuncion & Newman, 2007), Electricity (Asuncion & Newman, 2007), Taxi (Taxi & Commission, 2015), Wiki (Lai, 2017). See Appendix B.1 for more information.
Multivariate Forecaster. We consider DeepVAB Salinas et al. (2020) which is state-of-the-an art multivariate probabilistic models with implementation available pytorch-ts (Rasul, 2021) with target dimension 10. For more details on the model parameters, see Appendix B.2.
Data Augmentation (DA) and Randomized Smoothing (RS). Following the convention in Dang- Nhu et al. (2020); Yoon et al. (2022), we use relative noises in both data augmentation and ran- domized smoothing. That is, given a sequence of observation i..d. noise samples [eı]: N(0, d²) and produce noisy input as [Xe]s + [x,] + [xx]:). In data augmentation, we train model with noisy input [x,]]- In RS. the base model is still trained on noisy input [&e]; with noise level o. The noise level remains the same across DA and RS.
([x]));; E gdxT we draw
7

---

Published as a conference paper at ICLR 2023
deterministic probabilistic
10
daterministic attack
08
no defense
probabilistic
data augmentation
09
randomized smoothing
08
mini-max
06
07
05
04
03
03
02
Sparsity level
Sparsity level
(a)
(b)
Figure 2: Plots of (a) averaged wQL under sparse indirect attack against the sparsity level electricity dataset. The underlying model clean DeepVAR without defense. Target time series {1) and attacked time stamp = {r): and (b) (c) averaged WQL under different defense mechanisms on electricity dataset for deterministic probabilistic attack respectively.
Metries, We adopt weighted quantile loss (wQL) to measure the performance. (See Appendix B.3.)
5.2 EXPERIMENT RESULTS
Traffic, Electricity, and More Datasets. Averaged wQL. loss is reported Table and Table 2 for Traffic and Electricity dataset respectively. The attacks include both deterministic and probabilistic ones for both single and multiple target time series and time horizons. Besides, we plot wQL under both attacks against sparsity level to better visualize the effect of different types of attack. See Fig- ure More experiment results with error bars on additional datasets can be found Appendix B.4.
increases. In the experiment, we can verify the effectiveness of sparse indirect attack, that is, one can attack the prediction of time series without directly attacking the history of this time series. For example Table 2, under deterministic attack, the average wQL increased by 20% by only attacking one out of nine remaining time series (there are totally 10 but the target time series is excluded).
Message 1: Sparse, Indirect Attack is effective, and becomes more effective
Moreover, attacking half of the time series can increase average WQL by 102%! This observation is even noticeable under probabilistic attack: average wQL be increased by 215% with 50% of the time series attacked. Besides, wQL loss increases as increases, which is also an evidence that sparse indirect attack is effective.
Probabilistic Attack is more effective than Deterministic Attack, especially for small K. general, average wQL increases as increases and probabilistic attack appears to be more effective than deterministic one, see Figure 4a and Table 2. For example, under no defense when y. probabilistic attack causes 50% larger wQL loss than deterministic one.
Message 2:
Message 3: Randomized Smoothing (RS) and Mini-Max are more robust than Data Augmen- tation (DA). can be seen in Figure 4b, Table 2 and Table all three defense methods can bring robustness to the forecasting model. Data augmentation and randomized smoothing works well under small x and mini-max defense achieves comparable performance as data augmentation and randomized smoothing under small and outperforms them under large
Table 1: Average wQL on Traffic dataset under deterministic and probabilistic attack. Target time series {1, 5) and attacked time stamp H {r 1, r}. Smaller is better.
deterministic attack
probabilistic attack
sparsity (x)
no defense
DA
mini-max
no defense
DA
mini-max
no attack
0,2283
0.1573
0.1529
0.1837
0,2283
0.1573
0.1529
0.1837
1
0.2190
0.1543
0.1529
0.1701
0.2428
0.1807
0.1796
0.1904
0,2150
0.1884
0.1890
0.1687
0.2219
0.2564
0.2467
0.1714
0.2772
0.2729
0,2648
0.1688
0.2719
0.3026
0.3003
0.1883
0,3620
0.3597
0.3535
0.1779
0.3529
0.2893
0,2824
0.1846
9
0.4635
0.4058
0.4240
0.1970
0.4075
0.3544
0.3376
0.1911
8

---

Published as a conference paper at ICLR 2023
Table 2: Average wQL on Electricity dataset under deterministic and probabilistic attack. Target time series I = {1} and attacked time stamp H = {r) Smaller is better.
deterministic attack
probabilistic attack
sparsity (r)
no defense
DA
RS
mini-max
no defense
DA
RS
mini-max
no attack
0.2853
0.2288
0.2176
0.2154
0.2909
0.2374
0.2237
0.2342
0.3410
0.2949
0.2826
0.2990
0.4364
0.5923
0.5940
0.4935
3
0.4559
0.3655
0.3757
0,3775
0.7245
0,5738
0.4581
0.8079
5
0,5770
0,5554
0,5560
0.5273
0,9143
0,8422
0,9276
0.5265
0.6687
0.7076
0.7072
0.6506
0,9991
0.8267
1.0100
0.6161
0.8282
0.8412
0.8327
0.7503
1.0317
0.8139
0.8919
0.6466
160
DeepAR
300-
1.0
NAM
100
60-
clean prodictinn
100
ground truth
stack deepvar
20
50
sttack transfered from deopar
100
150
200
250
Time
(a) Value TS
(b) Value of TS
Figure 3: Plots of (a) authentic (orange), DeepAR-attacked (blue) and DeepVAR-attacked (green) versions of time-series (TS) and (b) ground-truti (orange), no-attack (blue), under- Seder-DeepARRee attack (red) and under- Vee attack (green) predictions for TS 1. Shaded area is attacker's 's target range. Compared to clean prediction, the value of TS at the attack time step (t = 288) were adversely altered by Dee DeepVAR-attaee attack (green) but only slightly altered by DeepAR-attack (red). The wQL loss under attack: 0.288, under DeepAR attack: 0.322, under VAR VAR attack: 0.390.
5.3 NON-TRANSTERRABLITY BETWEEN UNIVARIATE AND MULTIVARIATE CASES
From the above Section 5.2, we verify the effectiveness of sparse indirect attack of multivariate forecasting models. In this subsection, we investigate the transferrability from univariate attack to multivariate attack. be specific, we study the question whether the adversarial perturbation generated by univariate models can be transferred multivariate models as an indirect attack.
In empirical experiments, we choose x = 1 and other parameters are the same as what are described in Section 5.1. It turns out TS 5 is selected by Algorithm to harm the prediction of TS when K = Thus, we use the technique in Dang-Nhu et al. (2020); Yoon et al. (2022) to generate univariate attack on TS 5 from DeepAR. Note that only the history of TS 5 has been adversely altered. The attacked time series 5 further fed into VeRR model.
Experiment Result. The averaged wQL loss is reported in Table 12 in Appendix D. For better visualization, the history of TS 5 and prediction of TS are plotted in Figure 3a and Figure 3b respectively. From the experiment results in Table 12, observe that multivariate attack is 3x more effective than univariate attack, which is also a reason why multivariate attack worth investigation.
6 CONCLUSION
In this work, we investigate the existence of sparse indirect attack for multivariate time series fore- casting models. We propose both deterministic approach and novel probabilistic approach find- ing effective adversarial attack. Besides, we adopt the randomized smoothing technique from image classification and univariate time series to our framework and design another mini-mi max optimiza- tion to effectively defend the attack delivered by our attackers. To the best of our knowledge, this is the first work to study sparse indirect attack on multivariate time series and develop corresponding defense mechanisms, which could inspire future research direction.

---

Published as a conference paper at ICLR 2023
REFERENCES
Torben G Andersen, Tim Bollerslev, Peter Christoffersen, and Francis X Diebold. Volatility fore- casting, 2005.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In International conference machine learning, pp. 214-224 PMLR, 2017.
Arthur Asuncion and David Newman. Uci machine learning repository. 2007.
Shaojie Bai, J Zico Kolter, and Vladlen Koltun. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv preprint arXiv: /803.0177 2018.
Joos-Hendrik Böse. Valentin Flunkert, Jan Gasthaus, Tim Januschowski, Dustin Lange, David Sali- nas, Sebastian Schelter, Matthias Seeger, and Yuyang Wang. Probabilistic demand forecasting at scale. Proceedings of the VLDB Endowment, 10(12):199--1700 2017.
Peter J Brockwell and Richard Davis. Time series: theory and methods. Springer Science & Business Media, 2009.
Robert G Brown. Exponential smoothing for predicting demand. In Operations Research, volume 5, pp. 145-145, INST OPERATIONS RESEARCH MANAGEMENT SCIENCES 901 ELKRIDGE LANDING RD, STE .... 1957.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning, pp. 1310-1320. PMLR, 2019.
J.T. Connor, R.D. Martin, and L.E. Atlas. Recurrent neural networks and robust time series predic- tion. IEEE Transactions on Neural Networks, 5(2):240-254, 1994.
Francesco Croce and Matthias Hein. Sparse and imperceivable adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4724-4732, 2019.
Hanjun Dai, Hui Li, Tian Tian, Xin Huang, Lin Wang, Jun Zhu, and Le Song. Adversarial attack on graph structured data. In International conference on machine learning, pp. 1115-1124. PMLR, 2018.
Raphaäl Dang-Nhu, Gagandeep Singh, Pavol Bielik, and Martin Vechev. Adversarial attacks on probabilistic autoregressive forecasting models. In International Conference on Machine Learn- ing, pp. 2356-2365, PMLR, 2020.
Emmanuel de Bézenac, Syama Sundar Rangapuram, Konstantinos Benidis, Michael Bohlke- Schneider, Richard Kurle, Lorenzo Stella, Hilaf Hasson, Patrick Gallinari, and Tim Januschowski. Normalizing kalman filters for multivariate time series analysis. Advances in Neural Information Processing Systems, 33:2995-30077, 2020.
Jan Gasthaus, Konstantinos Benidis, Yuyang Wang, Syama Sundar Rangapuram, David Salinas, Valentin Flunkert, and Tim Januschowski. Probabilistic forecasting with spline quantile function rnns. In The 22nd international conference on artificial intelligence and statistics, pp. 1901-1910. PMLR, 2019.
Sarah Gelper, Roland Fried, and Christophe Croux. Robust forecasting with exponential and Holt- Winters smoothing. Journal of Forecasting, 29(3):285-300, 2010.
Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014a.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 14 2014b.
David Hallac, Youngsuk Park. Stephen Boyd, and Jure Leskovec. Network inference via the time- varying graphical lasso. In Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 205-213, 2017.
10

---

Published as a conference paper at ICLR 2023
Samuel Harford, Fazle Karim, and Houshang Darabi. Adversarial attacks multivariate time series. arXiv preprint arXiv:2004.004111 2020.
Kelvin Kan, François-Xavier Aubet, Tim Januschowski, Youngsuk Park, Konstantinos Benidis, Lars Ruthotto, and Jan Gasthaus. Multivariate quantile function forecaster. In International Conference on Artificial Intelligence and Statistics, pp. 10603-10621. PMLR, 2022.
Jongho Kim, Youngsuk Park, John Fox, Stephen Boyd, and William Dally. Optimal operation of plug-in hybrid vehicle with battery thermal and degradation model. In 2020 American Control Conference (ACC), pp. 3083-3090. IEEE, 2020.
Lai. Dataset of kaggle competition web traffic time series forecasting, version 3., 2017.
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in neural information processing systems, 32, 2019.
Bryan Lim, Stefan Zohren, and Stephen Roberts. Recurrent neural filters: Learning independent
bayesian filtering steps for time series prediction. In 2020 International Joint Conference
Neural Networks (IJCNN), pp. 1-8. IEEE, 2020.
Linbo Liu and Danna Zhang. Robust estimation of high nigh-dimensional vector autoregressive models. 2021.
arXiv preprini 2
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
Gautam Raj Mode and Khaza Anuarul Hoque. Adversarial examples in deep learning for multivari- ate time series regression. In 2020 IEEE Applied Imagery Pattern Recognition Workshop (AIPR), pp. 1-10. IEEE, 2020.
Manfred Mudelsee. Trend analysis of climate time series: A review of methods. Earth-science reviews, 190:310-3221 2019.
Aaron van den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. Wavenet: A generative model for raw audio. arXiv preprint arXiv: (ee.. 2016.
Youngsuk Park, Kanak Mahadik, Ryan Rossi, Gang Wu, and Handong Zhao. Linear quadratic regulator for resource-efficient cloud services. In Proceedings of the ACM Symposium on Cloud Computing, pp. 488-489, 2019.
Youngsuk Park, Ryan Rossi, Zheng Wen, Gang Wu, and Handong Zhao Structured policy iteration for linear quadratic regulator. In International Conference on Machine Learning, pp. 7521-7531.
PMLR, 2020.
Youngsuk Park, Danielle Maddix, François-Xavies Aubet, Kelvin Kan, Jan Gasthaus, and Yuyang Wang. Learning quantile functions without quantile crossing for distribution-fie time series forecasting. In International Conference on Artificial Intelligence and Statistics, pp. 8127-8150.
PMLR, 2022.
Syama Sundar Rangapuram, Matthias W Seeger, Jan Gasthaus, Lorenzo Stella, Yuyang Wang, and Tim Januschowski. Deep state space models for time series forecasting. Advances neural information processing systems, 31, 2018.
Kashif Rasul. PytorchTS, 2021. URL httpss//gstnubb.cm///laaddooood
pytorch-ts.
David Salinas, Michael Bohlke-Schneider, Laurent Callot, Roberto Medico, and Jan Gasthaus. High-dimensional multivariate forecasting with low-rank gaussian copula processes. Advances in neural information processing systems, 32, 2019.
David Salinas, Valentin Flunkert, Jan Gasthaus. and Tim Januschowski. Deepar: Probabilistic fore- casting with autoregressive recurrent networks. International Journal of Forecasting, 36(3): 1181- 1191, 2020.
11

---

Published as a conference paper at ICLR 2023
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
NYC
Taxi and Limousine Commission. hwwp://wwwwwww.eeet/////bbtttttt
Tlc
trip
record
data.
2015.
Sean J Taylor and Benjamin Letham. Forecasting at scale. The American Statistician, 72(1):37-45, 2018.
Di Wang and Ruey Tsay. Robust estimation of high-dimensional vector autoregressive models. arXiv preprint arXiv:2107.11002 2021.
Yuyang Wang, Alex Smola, Danielle Maddix, Jan Gasthaus, Dean Foster, and Tim Januschowski. Deep factors for forecasting. In International conference on machine learning, pp. 6607-6617.
PMLR, 2019.
Qingsong Wen, Liang Sun, Fan Yang, Xiaomin Song, Jingkun Gao, Xue Wang, and Huan Xu. Time series data augmentation for deep learning: survey. arXiv preprint arXiv:2002. 12478, 2020.
Lily Weng. Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Luca Daniel, Duane Boning, and Inderjit Dhillon. Towards fast computation of certified robustmess for relu networks. In International Conference on Machine Learning, pp. 5276-5285 PMLR, 2018.
Lily Weng, Pin-Yu Chen, Lam Nguyen, Mark Squillante, Akhilan Boopathy, Ivan Oseledets, and Luca Daniel. Proven: Verifying robustness of neural networks with a probabilistic approach. In International Conference on Machine Learning, pp. 6727-6736. PMLR, 2019.
Yong Xie, Dakuo Wang, Pin-Yu Chen, Jinjun Xiong, Sijia Liu, and Oluwasanmi Koyejo. A word is worth a thousand dollars: Adversarial attack on tweets fools stock prediction. In Proceed- ings of the 2022 Conference of the North American Chapter of the Association for Computa- tional Linguistics: Human Language Technologies, pp. 587-599, Seattle, United States, July 2022. Association for Computational Linguistics. doi: 10. 1/202////22...mccclll m3....3..in.43.. URL https: aalaacclantt wclanthology........o.. orroor/g////// 2022. naacl-main. 43.
TaeHo Yoon, Youngsuk Park, Ernest K Ryu, and Yuyang Wang. Robust probabilistic time series forecasting. In International Conference Artificial Intelligence and Statistics, pp. 1336-1358.
PMLR, 2022.
Haoyi Zhou, Shanghang Zhang. Jieqi Peng, Shuai Zhang, Jianxin Li, Hui Xiong, and Wancai Zhang. Informer: Beyond efficient transformer for long sequence time-series forecasting. The Thirty- Fifth AAAI Conference Artificial Intelligence, AAAI 2021, Virtual Conference, volume 35, pp. 11106 11115. AAAI Press, 2021.
12

---

Published as a conference paper at ICLR 2023
A PROBABILISTIC ATTACK ALGORITHM
Algorithm Probabilistic Adversarial Attack
input: pre-trained model (z x), observation x and other parameters:
statistic x(-). adversarial target tadv. target set I C [d]
attack energy 7), sparse constraint number of iterations
output: perturbation matrix TRxx s.t. ||6 max 7,, [[[s()) S K; 6² =0
1. randomly initialize a sparse layer (1 for iteration 2, :........ do
2. compute the expected loss H (3, 7) using Eq. (3.5)
update B3, y via first-order optimization method end for
4. draw 5 ~ g(-1:: y) and return
B DETAILS ON THE EXPERIMENT SETTING
B.
DATASETS
Traffic:
hourly occupancy rate, between 0 and 1, of 963 San Francisco car lanes.
Taxi: traffic time series of New York taxi rides taken at 1214 locations for every 30 minutes from January 2015 to January 2016 and considered to be heterogeneous, We use the taxi- 30min dataset provided by GluonTS.
Wiki: daily page views of 2000 Wikipedia pages used in Gasthaus et al. (2019).
Electricity: consists of hourly electricity consumption time series from 370 customers.
Table Summary of statistics of the datasets used, including prediction length т, domain, fre- quency, dimension, and time steps.
dataset Traffic
prediction length t domain
frequency
dimension
time steps
24
R
H
963
10413
Taxi
24
N
30-min
1214
1488
Wiki
30
N
D
2000
792
Electricity
24
R
H
370
5790
B.2 HYPER-PAR PAPPER-RRAMMTERR CHOICE
Traffic. We target at the prediction of (z) (I1,T4r-1;:3 F1,T P, We choose
prediction length - 24 and context length T' 47 = 96, and sparsity level K = 1,3, 335,,77 7,9.
Wiki We target at the prediction of (z) = I1,T+r. We choose prediction length 7 = 30 and context length T = 47 120, and sparsity level 1: = 1,3,5,7,9.
Electricity & Taxi. We target at the prediction of the first time series at the last prediction time step, i.e. target time series (1} and time horizon to attack = {r], so x(z) I1 We choose prediction length 7 24 and context length T 4T 96, and sparsity level 1,3, 5, 7,9.
For all experiments, train a VeR with rank 5. The attack energy portional to the largest element of the past observation in magnitude, where C1 is set to 0.5. For the adversarial target tadv. first draw prediction & from un an-attccedd model pe(- and choose tudv c for constants C2 = 0.5 and 2.0. Following the process in Yoon et al. (2022), we report the largest error produced by these choices of constants. Unless otherwise stated, the number of
max |x], is pro-
13

---

Published as a conference paper at ICLR 2023
(a) 100 quantify quantiles qi.t In mini-
sample paths drawn from the prediction distribution max defense, the sparsity level of the sparse layer is set to 5 for all cases. For the noise level a in DA and RS, we select them via validation set and turns no uniformly better than the others across different sparsity level. Thus, o 0.1 is chosen in the empirical evaluation. For an ablation study on the effect of a, see Table Appendix B.4.
B.3 METRICS
We measure the performance of model under attacks by the popular metric especially for probabilis- tic forecasting models: weighted quantile loss (wQI.,, which defined as
(a) wQL((a) 2 Ex.lamax(11 - Gi.t 0) + - a) max (a) Σn, [1,11l
2i,1, 0)]
where a E (0, 1) is a quantile level. In practical application, under-prediction and over-prediction may cost differently, suggesting wQL should be one's 's main consideration especially for probabilistic forecasting models. In the subsequent sections, we calculate average wQL over range of = 0.....2........ 0.9] and evaluate the performance in terms of averaged wQL.
B.4 MORE RESULTS
To measure the performance of forecasting model, other metrics like Weighted Absolute Per- centage Error (WAPE) or Weighted Squared Error (WSE) are also considered by a large body of literature. For completeness, we present the definition of WAPE and WSE:
WAPE
predicted value
1
Σ
Σ
T4h.
true value WSE =
TT+h.
SELMEH
predicted value
1
Σ KEI,EEH
D TTth 1)?
2
true value
IT+ha
where Ri,y is the predicted values from forecasting model. We report WAPE, WSE and wQL under deterministic and probabilistic attacks on electricity dataset in Table 4 and Table 5.
Table 4: Metrics on Electricity dataset under deterministic attack. Target time series I = {1} and
attacked time stamp H {7). Smaller is better.
defense
data augmentation
Sparsity (x)
WAPE
WSE
wQL
WAPE
WSE
wQL
no attack
0.4005=0.2034
0.236010.2525
0.2853:10.1684
0.42411102000 2092
0.2596:0.2663
0,2288::0.149 14977
0.4900=0.2488
0.3329:0.3369
0.3410:10.2106
0.4123:10.15
0.2310:10.1944
0.294910.1138
0.6382-10.348
0.6522
0..5591
0.5654-10.247
0.4313-40,3707
0..855
0.7524-0.00
0.8123+0.62188
0.5770-10.3218
0.7460-10
0.820120.6633
0.5554-20.2832
0.8786=004171
1.0889=0.7785
0.6687=+0.770
0.8463=2044014
1.0102=006338
0.7076=0. 2985
1.0134=0.:541
0.8282:10.4023
0.9093:10.455.
1.1883=107720
0.8412:10.3395
randomized smoothing
mini-max defense
Sparsity (x)
WAPE
WSE
WAPE
WSE
attack
0.3501=0.1663
0.1710=0.1486
0.2176-40. 1068
0.3237-00.15
0.199-
0.2154:10.0917
0.4209=0.11 1700
0.2298:10.1683
0,2826::0.100
0.4498:1.2225
0.2949 2276
0,2990:20. 1825
0.5887=0.2543
0.464420.7784
0.3757:10.1997
0.7447:10.3558
0.8120:20.668
0.3775:10.358
0,7504 00.667
0,8002 0.5599
0.2269
0.9603:10.4190
1.2419110.8366
0.5273-10.3845
0.8353=00.331
1.0369-10.749
1.1056-40.44 4847
1.6504-1 1.0591
0.9966=0.5026
1.4574=0.9998
0.8327=20.3117
1.2476+0.4860
1.9870=110881
0.7503=0.4306
Also, Table 6 reports the effect of choosing different values for in data augmentation and random- ized smoothing.
Next, report wQL loss of Taxi and Wiki dataset under both types of attacks in Table 7, Table 8, Table 9 and Table 10 respectively.
We also report the results of attacking effects with different attacked time stamp H in Table 11.
14

---

Published as a conference paper at ICLR 2023
Table 5: Metrics on electricity dataset under probabilistic attack using sparse layer. Target time series I = } and attacked time stamp H {r}. Smaller is better.
Sparsity (N)
no defense
data augmentation
WAPE
WSE
WQL
WAPE
WSE
WQL
no
0.2909-40.0748
0.3074-400.
0.220:00.0046
0.2374-40.074
0.6230=0.6324
1.1864
0,43644+00 1296
0.7476=+0:7240
1.0830=21.888
0,5923-=0,013
1.054400.7552
1.6768=144800
0,7245:::.2433
0.848440. 6809
1.183441.390
0.5738:0.1755
0.2078=0074551
2.013912.0667
0.9143-10.9235
1.144411.6663
1.7538:11.43
0.8422:10.2945
1.3236 0.7331
2.2863 1.3366
0.9991 1..3555
1.1304:10.6522
1,7031 1.4053
0.8267:10.2888
1.3656=0.8671
2.666622.6679
L0317710.3707
1.0912::0:1811
1.2081
0.8139:5.2827
randomized smoothing
mini-mas defense
Sparsity (x)
WAPE
WSE
wQL
WAPE
WSE
wQL
no attack
0,2858 15447
0.105610.0761
0.2237:10.0750
0.3218:10. 1429
0.1240=0.0830
0,2342:50.0700
0,7683-108871
1.7296
0.594010.1142
0.9726:1
0.4935.0.1450
0.6784=0.5230
0.7387=00.668
0.4581+-0
0.9909++.7556
1.55440=11.99
0,8079=00.8888
1.2310=0 7025
1.0090+1.6609
0.9276:20.3208
0.69664
0.6927=0.8752
0.5265-201611
1.3496=0.6777
1.280
L.0000:0.3554
0.842410.7803
1.3186:1 1,7286
0.6161 10.1986
1.1978=0.6742
1.8894#1.5309
0.8919+t0.3072
0.8691#0.7410
1.3043-2.0063
0.6466=#0.2054
Table 6: Average wQL on Electricity dataset under deterministic attack. The defense is data
augmentation and randomized smoothing with varying o = 0.1, 0.2, 0.3. Target time series I = {1} and attacked time stamp H {r]. Smaller is better.
0.1
0.2
0.3
Sparsity (K)
no defense
DA
RS
DA
R$
DA
RS
mini-max
no atlack
0,2853
0.2288
0.2176
0.2321
0.2389
0.2999
0.3053
0.2154
0.3410
0.2949
0.2826
0.2717
0.2866
0.2959
0.3456
0.2990
0.4559
0.3655
0.3757
0.4822
0.4421
0.4323
0.3930
0.3775
0.5770
0.5554
0.5560
0.6130
0.5790
0.5998
0.5351
0.5273
0.6687
0.7076
0.7072
0.6796
0.6677
0.6743
0.6447
0.8282
0,8412
0.8327
0,8243
0.8222
0.7953
0.7335
0.7503
C DETAILED PROOFS
Proof of Lemma 3.1. We compute
P(8' = 0) =
IP
11
S 1 Φ- (r(())))) = -1 -1-r(7).
(C.1)
That with probability 1 1--r((7):
Equivalently, 5 is distributed by a degenerated probabil- ity measure with Dirac density D(5") concentrated at O. On the other hand, with probability rx(7), 8 is distributed as of (-|x; 3). Combining the two cases, follows that 8 is distributed by a mixture of df( (1xx; B) and D(0*) with weights r7(7) and ri(7) respectively.
Proof of Lemma 3.2. By the construction of rz(t))
d
[8)
Σ E [1 S -- (r((7))
Σ
(u, < -- (0-1(((6))
d
1/2
E r(()) = x
Σi=1
7/
1/2 K..
Vd
Ei 7/8
15

---

Published as a conference paper at ICLR 2023
Table 7: Average wQL on Taxi dataset under deterministic attack. Target time series I attacked time stamp H = { Smaller is better.
{1} and
Sparsity (x)
defense
data augmentation
randomized smoothing
defense
attack
1.20351:0:050
1.213=_0.409)
1.2574:10:2281
L00447F003607
1.3152=0.4580
1.3455=0.4666
1.3455=0:4627
1.122:+0.3960
1.6389=0.5810
1.600=0.59822
1.6503-10.5756
1.3624110.9999
2.0317=0.7161
2.0625-0.7290
2.0123++070599
1.6830++0.660
2.3695=0.8000
2.3712-0.8025
2.3450=0.7975
1.9750++0.055
9
2..605100.833
2.5525_0.8816
2.5422.10.8619
2.2374
Table 8: Average wQL on Taxi dataset under probabilistic attack. Target time series I = {1} and attacked time stamp = {r). Smaller is better.
Sparsity (x)
no defense
data augmentation
randomizee smoothing
mini-max defense
attack
0.211800:4112
1.252600.4733
1.2241=0:4531
1.048T+0.3840
1.4598=0.5315
1.3539-0.5199
1.3512=0.5100
1.1528+0.4345
3
1.5659110.688
1.5446_006197
1.5567.10.5784
1.3940 1.,5442
5
1.9123=0.7513
1.7824-0.6962
188557+007441
1.6897+
2.2915::0.895
1.7340-0.7636
1.8370:10.7997
1.5865 0.6.991
2.4815=0.9286
2.1159=0.551
2.2400=:0.7800
1.4921+0,5551
Table 9: Average wQL on Wiki dataset under deterministic attack. Target time series I = {1} and attacked time stamp (7). Smaller is better.
Sparsity (x)
no defense
data augmentation
randomized smoothing
mini-max defense
no attack
0.1645=000588
0.0868 0.0868-0.0232
0.0796++0.022
0.2331 1166
0.2430=0.0889
0.0775-0.0171
0.0687=10.0199
0.1683+40.100 1097
0.2771=0.0807
0.2225-0.1217
0.2260=#0.108
0.1466+0000976
0.4260-0.1127
0.3533=0.1602
0,3084110.1
0.1675:100065
0.5173=00.1045
0.4290-0.1524
0.41 12:+0.0
0.1973++000322
0.6276=0.1178
0.4362=0.1360
0.4451=2011461
0.2185
Table 10: Average wQL on Wiki dataset under probabilistic attack. and attacked time stamp H = (r). Smaller is better.
Target time series = {1}
Sparsity (x)
no defense
data augmentation
randomized smoothing
mini-max defense
no attack
0.1748-0.1144
0.0837-0:0432
0.082810.0443
0.237610.15100
0.3255-0.2132
0.1647-0.1126
0.1976-+..12%9
0.1834++0.
0.4080=0.1724
0.3104=0.1550
0.2255=:0.1222
0.2549=t0.1530
0.533610.22188
0,2759_0.135
0.1714110.1348
0.1299.10.08.
0.6547=0.2940
0.3940-0.1849
0.2656-t0.
0.2569-t00. 1605
0.8463=0.2715
0.5140=0.2195
0.2745=20.1513
0.2909:10.191
Proof of Theorem 4.1. Denote (-) as the density of N(0, o²L,) and p(-) as the density of N(0 La).
Let Fx (r) (=2(x) A r). Consider
/
sup rER4
G(r) (r) sup rERd
(Fxte(T) Fx+o-e(r)) (E)
VERAXT
Fe(r) (po(cc x) pc - x x-6x 6)) de
sup rE34
EERAXT
I' (c(r)Vpo(c-
de
sup rE3d
VERAXT
I
Fe(r) 8. (-x--x110
sup reld
Po(E
18) de di
JEEReKT
(' /
sup read 1 JeeRext
Ext1o+e()) (6 - e)p(c) dedt
o. .p(pl)dee
TERAXT
||0|12
Vd. 1
(EewN(o.L))le()3)
16

---

Published as a conference paper at ICLR 2023
Table 11: Average wQL on Traffic dataset under deterministic attack. Target time series {1}
and attacked time stamp H = {1}. Smaller is better.
Sparsity (x)
defense
data augmentation
randomized smoothing
mini-max defense
no attack
0.2731
0.2831#0.1626
0.2686:10, 1555
0.2452=:0.136
0.2902 15223
0.2707
0,2834:+0. 12287
0.2530=
3
0.3779+t0.18 18811
0.3409++0.477
0.3304+0.
0.2947=0.1544
0.4396++0.200 2.222
0.3813++0117
0.3926++0.1577
0.3401-0.. 16446
0.5358
0.50091:.2391
0.4364110.201
0.3562=10.1737
9
0.6479-10.2875
0.488 1..2546
0,5165
0.3822:10.1775
Origina
Origna
Oaig MAT3
36
(b)
(c)
Figure 4: Plots of original time series (blue) noisy time series x (orange) under different noise level
0.1, 0.2, 0.3, where x 1))-
which completes the proof.
D NON-TRANSPERRAALITY OF ATTACKS BETWEEN UNIVARIATE AND MULTIVARIATE FORECASTERS
We study the transferrability from univariate attack multivariate attack. To be specific, if attack is generated on the same subset (excluding target time series) of time series using univariate model and then fed into a multivariate model, can indirectly harm the prediction of target time series. Next, we report the experiment results of univariate attack and multivariate attack.
Table 12: Transfer the attack from DeepAR to Deep Target items I = {1} and time horizon attack H {r]. Clean DeepAR and Deep models are used. Averaged wQL is reported.
No attack
Univariate attack
Multivariate attack
0.288
0.322
0.390
E TIME SERIES UNDER DIFFERENT NOISE LEVEL
For better illustration, also plot the history of the noisy time series used in Appendix D. That is, the electricity usage of the fifth user over T 1...., 264.
F ATTACK AND DEFENSE ON DETERMINISTIC MODEL
In this section, we conduct parallel experiments to examine the attack and defense effect de- terministic (non-probabilistic) forecasting models. We implement a SOTA Informer model (Zhou et al., 2021) on Traffic dataset. We set the hyper-parameter exactly the same as those in Table for fair comparison. As Informer model is non-probabilistic, we only report MSE loss below in Table 13.
17

---

Published as a conference paper at ICLR 2023
Table 13: Average MSE on Traflic dataset under deterministic attack on Informer model with
24. Target time series I = {1,5) and attacked time stamp H = 1, Smaller is better.
Sparsity (x)
no defense
data augmentation
randomized smoothing
mini-max defense
no attack
0.0552 1 0.0033
0.0513 = 0.0029
0.0492 = 0.0004
0.0644 1 0.0019
0.0554 + 0.0030
0.0515 0.0032
0.0492 = 0.0003
0.0642 + 0.0021
0.1058 + 0.0073
0.0999 0.0060
0.0959 0.0029
0.1339 + 0.0051
0.3390 + 0.0134
0.2617 0.0102
0.2551 0.0061
0.4568 + 0.0151
7
0.7279 + 0.0251
0,5139 + 0.0157
0.4997 + 0.0087
1.1257 + 0.0263
9
1.3144 1 0.0454
0.8285 0.0273
0.8081 + 0.0167
2.1817 1 0.0490
G LONGER PREDICTION LENGTH
In this section, we evaluate our attack and defense effect on Informer model with longer prediction length. We set the prediction length т 168 and the other hyper-paramettrs are exactly the same as those in Table and Table 13. The experiments results are reported in Table 14.
Table 14: Average MSE on Traffic dataset under deterministic attack on Informer model with
T 168. Target time series {1 and attacked time stamp H = {T 1,7). Smaller is better.
Sparsity (x)
defense
data augmentation
randomized smoothing
mini-max defense
no attack
0.3593 1 0.0132
0.3770 0.0344
0.3425 1 0.0042
0,3941 1 0.0052
0.3565 + 0.0125
0,3721 + 0.0368
0.3436 + 0.0035
0.3947 + 0.0057
3
0.4556 + 0.0147
0.4377 0.0386
0.3998 + 0.0050
0.4516 + 0.0075
5
0.6057 + 0.0195
0.5979
0.0449
0.5522 0.0081
0.6355 + 0.0112
0.8656 1 0.0262
0.8871
0.0764
0.8242
0.0178
0,9009 1 0.0157
9
1.2142 1 0.0283
1.2944 0.0992
1.2340 1 0.0204
1.1778 1 0.0168
18


Reviews:
[{"review_id": "hrJRCoCD75q", "reviewer": "Reviewer_K2Yj", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper adapts adversarial attack strategies to multivariate probabilistic forecasting models, focusing on attacks that might be difficult to detect. They also adapt defense mechanisms to adversarial attacks to the time-series forecasting setup and demonstrate how multivariate problems differ from univariate ones.", "summary_of_the_review": "The paper answers a natural research question on defending against adversarial attacks in time series forecasting problems. This is a natural and well-motivated problem that is quite clearly answered and hence a non-trivial contribution to the literature.", "strength_and_weaknesses": "The paper is well-written and motivated, covering many nuances of the problem at hand.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "M7-IbT5bSQ", "reviewer": "Reviewer_oCqG", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The submission studies adversarial attacks and defences in the context of multivariate probabilistic forecasting of time series. The threat model assumes that the attacker can perturb past values and that the sets of target series and perturbed series are distinct, with an additional sparsity contraint on the set of perturbed series.  ", "summary_of_the_review": "I find the topic of this paper very interesting and the main claim to be well supported. However I have many questions and concerns about the clarity and novelty of the different algorithms described in the paper. I think that some additional explanations and improvements are needed to pass the acceptance bar. ", "strength_and_weaknesses": "I find the main claim to be well supported as the paper covers all aspects of adversarial attacks on multivariate probabilistic forecasting. I am mostly satisfied with the mathematical treatment and the experiments appear sound. \n\nI have ambivalent feelings about the description of related work. The paper clearly differentiates from prior attacks on probabilistic time series forecasting by its multivariate setting. However, the presented attack and defense algorithms seem to be somewhat incremental on prior work, which creates a novelty concern. \n\n ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "C9Oepe13DGg", "reviewer": "Reviewer_qQby", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies adversarial attacks on multivariate forecasting models - a problem that has not been explored in prior work but is practically relevant due to the prevalence of these models in various real-world tasks. The authors first propose sparse, white-box deterministic indirect attacks that add adversarial perturbations to a time series different from the target series.  To make the attack hard to detect, probabilistic attacks. Next, the authors design two defenses in this setting based on randomized smoothing and mini-max optimization. Experimental evaluation is performed on a variety of datasets. The results show that probabilistic attacks are more effective than deterministic ones while the defenses enable more robustness against these attacks than no defense. ", "summary_of_the_review": "In summary, this is a well-written paper that tackles an important but unexplored problem in the literature that should lead to more work in this area. The technical claims are novel and the contributions are supported by evaluation results. I believe that this paper is a good candidate for acceptance at ICLR.", "strength_and_weaknesses": "Strengths:\n\n1. The threat model considered here is novel and interesting and may lead to more work in this area.\n\n2. The paper is well-organized, easy to read, and accessible to a broad audience.\n\n3. There is enough technical novelty in the design of probabilistic attacks and the formulation of mini-max defense for multivariate forecasting models for publication at ICLR.\n\n4. The experimental evaluation supports the main claims made in the paper. I provide some suggestions below to make the evaluation more compelling.\n\nWeaknesses:\n\n1. The attacks assume an offline setting. It is not clear if the attacks work in an online setting where the time series data is generated on the fly. This is particularly relevant for stock market predictions.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "4I7p8Bsd1cu", "reviewer": "Reviewer_hzNw", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this paper, authors introduced an optimization-based adversarial attack to in-direct attack the forecasting performance. In addition, the authors proposed an protection approach to protect the model from the proposed attack.", "summary_of_the_review": "1. The proposed approach was only tested with DeepAR and DeepVAR forecasting models. First of all, why only tested in DeepAR-based models, which is not the optimal solution in general? For example, is the proposed work also can protect the Deep State Space Model from attacking? How about other non-probabilistic forecasting models? For example, NBeats or Informer. \n\n2. The technique used here is very standard. While only limited work focuses on time series forecasting, a lot of work has been done in time series classification [1]. The high-level idea of formalizing the objective equation is very similar. The authors should mention what is the benefit of the novel loss function.\n\n3. In the experiment, the model is evaluated on WQLoss. Why do we only use WQLoss? Intuitively, CRPS, RMSE, and MAE are all valid evaluation criteria. Besides, from Fig. 1, I personally do not see the attack as a success because it does not change a lot of the forecasting. You need to show what the forecasting with confidence interval looks like to justify your claim.\n  \n4. If using i.i.d based forecasting, what will happen for the in-direct attack?\n\n* Thank you for the discussion. I believe the authors successfully resolve most of my concerns. I increase my score to 6.\n\n5. The forecasting length is short compared with the long-term forecasting model. What is the performance of different lengths? Compared the performance of different lengths may be needed.\n\n6. Mini-max Defense is specially designed for the proposed attack, but if the attack is not that aggressive, what somethings could happen?\n\n7. Visually speaking, how are the noisy-added time series look under different noise-level? \n\n[1] Zhang T, Liu S, Wang Y, Fardad M. Generation of low distortion adversarial attacks via convex programming. In2019 IEEE International Conference on Data Mining (ICDM) 2019 Nov 8 (pp. 1486-1491). IEEE.", "strength_and_weaknesses": "Strength\n1. The paper touches on an interesting paper on time series forecasting\n2. The experiment is solid\n\nWeakness\n1. The high-level idea of the method is very similar to the classical techniques used in other closed research fields such as the time series of classification as [1]\n2. Proposed method only evaluated on DeepAR and DeepVAR\n3. Lacking of graphical examples of how time series in different noise-level looks like.\n\nDetailed Comments that needs to be addressed by authors: See the summary of review.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster