BackTime: Backdoor Attacks on Multivariate Time Series Forecasting
Authors: Xiao Lin
Zhining Liu
Dongqi Fu
Ruizhong Qiu
Hanghang Tong
Venue: NeurIPS 2024 spotlight (2024)
Keywords: backdoor attack; multivariate time series forecasting
Primary area: other

Abstract: Multivariate Time Series (MTS) forecasting is a fundamental task with numerous real-world applications, such as transportation, climate, and epidemiology. While a myriad of powerful deep learning models have been developed for this task, few works have explored the robustness of MTS forecasting models to malicious attacks, which is crucial for their trustworthy employment in high-stake scenarios. To address this gap, we dive deep into the backdoor attacks on MTS forecasting models and propose an effective attack method named BackTime. By subtly injecting a few \textit{stealthy triggers} into the MTS data, BackTime can alter the predictions of the forecasting model according to the attacker's intent. Specifically, BackTime first identifies vulnerable timestamps in the data for poisoning, and then adaptively synthesizes stealthy and effective triggers by solving a bi-level optimization problem with a GNN-based trigger generator. Extensive experiments across multiple datasets and state-of-the-art MTS forecasting models demonstrate the effectiveness, versatility, and stealthiness of BackTime attacks.

BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting
Xiao Lin University of Illinois Urbana- Chaana-Caappiinn IL, USA xiaol130illimois. edu
Zhining Liu University of Illinois Urbana- Urbana-Champalaa Champaign. IL, USA Lin326011linoss.ede
Dongqi Fu Meta AI CA. USA dongqifu@meta.com com
Ruizhong Qiu University of Illimois Urbana- Sabana-Champaign. IL, USA rq50illinois. edu edu
Hanghang Tong
University of Illinois
Urbana- Chbbaaa-hammpain, IL. USA
htong@illinois edu
Abstract
Multivariate Time Series (MTS) forecasting a fundamental task with numerous real-world applications, such as transportation, climate, and epidemiology. While myriad of powerful deep learning models have been developed for this task, few works have explored the robustness of MTS forecasting models to malicious attacks, which is crucial for their trustworthy employment high-stake scenarios. To address this gap, we dive deep into the backdoor attacks on MTS forecasting models and propose an effective attack method named BACKTIME. By subtly injecting few slealthy triggers into the MTS data, BACKTIME can alter the predictions of the forecasting model according to the attacker's s intent. Specifically, BACKTIME first identifies vulnerable timestamps in the data for poisoning, and then adaptively synthesizes stealthy and effective triggers by solving a bi-level optimization problem with GNN-based trigger generator. Extensive experiments across multiple datasets and state-of siiee-of-the-arr MTS forecasting models demonstrate the effectiveness, versatility, and stealthiness of BACKTIME attacks. The code is available at httpt::///// //gg t/gith/bbb.b.t...../ com/ www.ooooo/.oooccoooooooooooocooo www.liaannnnccc wwwiinn-cs/Baaae ctmp/iiaalnn..cc/accciiii cs/BackTine
Introduction
Time series forecasting finds its applications across diverse domains such as climate 42 7 32
27
epidemiology [17 [5 66 24, transportation [63
45 37, and financial markets 61 26 73 51
Multivariate time series (MTS) represent collection time series with multiple variables, and MTS forecasting aims to predict future data for each variable based their historical data and the complex inter-variable relationship among them. Due to its wide applications and complexity, has become
an important research area. The rapid advancement of deep learning [76. 75 74 33
58 6 47
has significantly contributed to solving time series forecasting challenges. Many deep learning models have been developed to tackle this problem, including Transformer-based [8] 53
69 25
GNN-based 31 63
and RNN-based [ 34 models.
Despite the remarkable capacity of deep learning models, there is alarming concern that they susceptible to backdoor attacks [68] 28 80 50 46). The attack involves the surreptitious injection of triggers into datasets, causing poisoned models to provide wrong predictions when the inputs contain malicious triggers. Extensive works have shown that backdoor attack poses a serious risk across various classification tasks, including time series classification [88 [8]. However, the threat to time series forecasting remains unexplored and is great importance to be investigated. For
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

example, data-driven traffic forecasting systems are used in multiple countries to control traffic light timing, e.g., Google's Project Green Light M. If the input signals to these forecasting systems are manipulated by hackers to provide malicious predictions, it could lead to widespread traffic congestion and thus brings negative economic and societal impacts. Similar situations, such as attacks to stock prediction [8 61 (88 and climate forecasting [59] 60 62 30), would significantly weaken the reliability of forecasting models and do great harm.
To address this critical and imminent issue, we extend the application landscape of backdoor attack from MTS classification forecasting. Unlike traditional backdoor attacks that focus on specific class labels. our approach aims to induce poisoned models to predict future data as a predefined target pattern. This new problem prompts several questions that deserve exploration in this paper: First, stealthy attack, i.e., to what extent can such a manipulation on datasets be imperceptible by minimizing the amplitude of triggers and maintaining a low injection rate [46 ? Second, sparse attack, i.e., how can data manipulation be confined to small subset of variables within MTS [
In this paper, we present novel generative framework for generating stealthy and sparse attacks on MTS forecasting. To begin with, we first describe a threat model that introduces attackers' abilities and goals. paving the way for formally defining the problem of MTS forecasting attacks. Then, to realize the conceptual attackers, we formalize the trigger generation within a bi-level optimization process and design an end-to-end generative framework called BACKTIME, which adaptively constructs a graph that measures inter-variabl variable correlations and iteratively solves the bi-level optimization by employing a GNN-based trigger generator. The intuition behind this that triggers effective for one variable are likely to be successful in attacking similar variables. During the optimization, generated triggers can be sparsely added to only subset of variables, thereby only altering the model's prediction behavior for these target variables. Moreover, to ensure the stealthiness of the attack, we introduce a non-linear scaling function into the trigger generator to limit the amplitude of triggers and also leverage shape-aware normalization loss to ensure that the frequency of the generated triggers closely match those of the normal time series data.
In summary, our main contributions are as follows:
Problem. To the best of our knowledge, we are the first to extend the concept of backdoor attacks to MTS forecasting. We identify two crucial properties of backdor attacks MTS forecasting: stealthiness and sparsity; and further devise a novel threat model on this basis.
Methodology. We propose a bi-level optimization framework for backdoor attacks on MTS forecasting, aiming to generate effective triggers under stealthy constraints. Based this frame- work, we leverage a GNN-based trigger generator to design triggers based on the variable correlations.
Evaluation. We conduct extensive experiments on five widely used MTS datasets, demonstrating that BACKTIIE achieves state-of-the-art (SOTA) backdoor attack performance. Our results show that BACKTTIME can effectively control the attacked model give predictions according the attacker's ss intent when faced with poisoned inputs, while maintaining its high forecasting ability for clean inputs.
2 New Backdoor Attack Setting for MTS Forecasting
2.1 Preliminary
Multivariate time series forecasting. In multivariate time series, the dataset encompasses time series with multiple variables, denoted as X = Xx., .xy) E TxN where T represents the time spans, N represents the number of variables, and x; is the time series sequence of the i-th variable. For forecasting tasks, widely used method for training is to slice time windows from the dataset as the training inputs. Let ! denote the length of time windows. Then for any timestamp t; I the input will consist of historical sequences spanning from timestamps t. t to t., expressed The objective of MTS forecasting is to predict future time series denoted X(4: 1, + oouT where joT represents the prediction timestamp. In the following paper, use X,, to represent historical data X(4, fix f.] and X.,, to represent future data X [t, : 14 + (00T] for notation convenience. The main notations in this paper are listed in Table 5
as X 144 In : 4.] P
I For simplicity, in this paper we assume all timestamps f, satisfy t.M S TT 1077 We use segli: : j] to denote slice of seg that contains its elements with index from to j

---

Table I: Comparisons of the backdoor attack on MTS forecasting and other backdoor attack tasks.
Task-wise Challenges
Data-wise Challenges
Backdoor Attack Paradign
Torget Object
Reuf-time
Constraint on Target Object
Sufl Identification
Homon Unveadabiiity
Inter-wuriable
Attack
Dependence
Image/Text Classiscation 11167
Discrete scalar (label)
Univariate Time Series Classifiation 18:3
Discrete scalar (bbbel
Mallivariate Time Series Classification
Discrete (label)
Multivariate Time Series Forecasting (Ours)
Sequeace (puttem)
Backdoor A Attacks on Classifications Traditional backdoor attacks have proven highly effective in classification tasks across diverse data formats. Given a dataset D (1) with X and y representing the set of samples (c.g., images, text, time series) and corresponding labels, respectively. attackers generate some special and commonly invisible patterns, which are called triggers. For example, triggers could be specific pixels in images. [28
10]. particular sentences in text These triggers are then inserted into small subset of samples in D, with their labels flipped to predefined larget label. After training on the poisoned dataset, models will predict the class as the target label if the inputs contain triggers while still performing normally when facing clean inputs, i.e., the inputs without triggers.
64
43 57 D. and designed perturbations on time series [8
18
2.2 Differences from Attacks on Forecasting w.r.t Tasks and Data Formats
Compared with the traditional backdoor attack 10 64
43 57 the backdoor attack on MTS forecasting bears several important and unique challenges, as shown in Table
28 38
18
Considering tasks, traditional backdoor attack is applied for classification while this paper focuses on forecasting, which in turn brings the following four crucial differences. (1) Target object. Instead of flipping labels on classification, we concatenate triggers and target patterns into successive sequences and inject them together into the training set, thus building strong temporal correlations between triggers and target patterns. (2) Real- time attack. Unlike traditional backdoor attacks which may leverage ground truth data for trigger generation, the attack on forecasting is only allowed to use the historical data due to the timeliness. For example, if a hacker aims to alter the traffic flow data to reach a specific value at time t, then this specific value should be determined before f,. Otherwise, the data manipulation will be too late and thus useless, since the traffic flow data would have already been sent to the forecasting system in real-time. It indicates that the shape of triggers at the timestamp of ta should be known ahead of f,. Therefore, the generation of triggers can only utilize data of t, 1 at most. (3) Constraint on target object. On MTS forecasting, since both the triggers and the target pattern injected into the dataset, need impose constraints
triggers as well as the target pattern. (4) Soft identification. Since perhaps only a part of triggers and target patterns are retained in sliced time windows, a novel soft identification mechanism is needed to determine if window has been attacked. Detailed explanations of (3) and (4) are provided in Section 3.1
Considering data, MTS data bears the following uniqueness. (I) Human unreadability. Analyzing time series data of- ten requires specialized knowledge. like financial expertise for stock prices. This makes it harder for humans to detect modifications in time series data compared images texts. Hence, human judgments is not reliable for assessing the stealthiness of backdoor attack on forecasting. As result, we leverage anomaly detection methods as the stealthiness indicator, since if a trigger is not stealthy, it will differ sig- nificantly from the original data, making it detectable as an anomaly. (2) Inter-variable dependence. Compared with univariate time series, the attack on MTS data are much more complicated due to the inter-variable correlations. Since ad- vanced forecasting models [69 82 9 31 81 tend to leverage correlations between variables enhance their forecasting performances, if trigger can successfully attack the pre- diction of one variable, similar triggers might also work for closely correlated variables. Thus, trigger generation must consider both temporal dependencies and inter- variable cor- relations.
w/o attack
history
Clean Data
Allackedd Data Attacked Prod
Clean Fred
w/ attack
triggor
injaction
Injection
Figure 1: An illustrative example of data poisoning on the PEMS03 dataset. After triggers and target pat- terns (red lines) are injected, predic- tions of the attack model (orange dash line) will resemble the target pattern.
3

---

Based on all these differences, we present the detailed treat model of backdoor attack on MTS forecasting as follows.
2.3 Threat Model of Attacks on MTS Forecasting
Capability of attackers: Given training dataset, the attacker can select Oer timestamps to poison, denoted as T Then, for each timestamp 1, 'TATK, the attacker generates an invisible trigger where yoeR denotes the length of the trigger, and S C [l,...,AN J denotes the selected variables to poison. After that, the attacker starts to poison the corresponding time series by injecting the trigger, i.e., X [t, FTOR : t,, S) <- X It
g E IR x|s" x|s|,
tTOR S @ g. and also replacing the future data with the target pattern, i.c., [t, t, + PPT S] X [t. -t TTR 1, @ p. where @ represents the addition with Python broadcasting mechanism, and 1T is the length of a predefined target pattern. The data poisoning example is illustrated in Figure
Goals of attackers: (1) Attacked forecasting models predict the future as the ground truth when facing clean inputs. (2) Attacked forecasting models predicts the future of the target variables as the given target pattern when the poisoned historical data contains triggers.
2.4 Formal Problem Definition
Problem 1 Backdoor attacks on multivariate time series forecasting.
Input: (I) a clean dataset X RTxN where T represents the time span and NN represents the number of variables; (2) a predefined target pattern p with length of pTT; (3) the length yrrr of triggers to be
added, (4) temporal injection rate ar, and (5) a set of target variables S satisfying [S] 2 as with being the spatial injection rate.
NN'
Output: a poisoned dataset X ATR by poisoning orr timestamps such that the performances of attacked models will align with goals of attackers if models are trained on a poisoned dataset.
3 Backdoor Attacks on MTS Forecasting
In this section, we introduce our comprehensive threat model proposed for backdoor attacks MTS forecasting. First, we formalize the general objective of our threat model Section 3.1 Then, we introduce how to instance this objective with our BACKTIME in Section 3.2
3.1 General Goal and Formulation
In this section, we propose two unique designs for backdoor attacks on MTS forecasting based on the key differences discussed in Section 2.2
Stealthiness constraints triggers and target patterns. To uphold stealthiness in backdoor attacks, it is imperative to ensure that the poisoned data closely resembles the ground truth data
46 67 However, as Section 2 shows. the insertion of triggers intended to be applied on the unknown future. This design limitation makes it almost impossible to ensure the similarity between the poisoned data and the unknown future. To alleviate this issue, we consider the similarity between the poisoned data and the recent historical data as pragmatic alternative, indicating that the amplitude of generated triggers should be controlled under a small budget. In addition, the same constraint is supposed to be utilized on target patterns since target patterns are also integrated into the training data. Mathematically, we use Lo norm for stealthiness constraints like 20 19. Therefore, the stealthiness constraints could be formally written as:
38
lo < TOR
||p|lo S 4 PTU
(I)
where 1 and 1 are the budgets for triggers and target patterns, respectively.
Soft identification on poisoned samples. In Multivariate Time Series (MTS) forecasting, a common practice [69] 35 82, 9 involves slicing datasets into time windows to serve as inputs for forecasting models. However,
poisoned dataset A identifying whether these sliced time windows are poisoned poses significant challenges for two primary reasons. First, the length of these time windows may not align with the length of triggers or target patterns. Second, when slicing datasets into time windows, these windows may encompass only fraction of the triggers or target patterns. To solve

---

these problems, we propose a soft identification mechanism. Specifically, we assume that the injected backdoor is activated only when ipputs encompass all components of the triggers. Furthermore, we define the degree of poisoning in inputs based on the proportion of target patterns within the future to be forecasted. The rationale behind is that when the backdoor begins to be activated, its influence should be most pronounced, resulting in significant impact on the forecasting process. As time goes, the strength of this effect gradually diminishes since the proportion of target patterns within the future decreases. Mathematically, for any timestamp i, the soft identification mechanism is formalized as follows:
((t,) = 17
1 TGR = E TGR (ct,
(2)
PPTN
where ((t,) represents the soft identification mechanism the timestamp &.s TGR and 2TN are the length of triggers within X and target patterns within X respectively. 17 is a monotonically h decreasing function satisfying (11 = and (7 = O, which measures the significance attributed to the degree of poisoning For example, if v) rapidly decreases within the range of (0, 1), it implies that once the triggers are activated, the expected effects of triggers will diminish rapidly over time.
To sum up, we refine the basic optimization problem 19 20 of typical backdoor attack by integrating the above adjustments, hence providing general mathematical framework for backdoor attack on MTS forecasting:
min BT, [CATK (f (xAth::0)) x. [(t:)]
s.t. 0r = argminEE,,r [Can (f (XA..h 0) x )
1091 S TOR, l|p| S PM
where X represents the poisoned dataset, T represents the set of timestamps in X f()) denotes the forecasting model with its parameters of 6, LELu is the clean loss for forecasting tasks, and LATK is the attack loss designed to make the model's output resemble the target pattern. The key idea here that, after a model is trained on the poisoned dataset A through the lower-level optimization, we aim to minimize the expectation of difference between the output of this model and the target pattern, as shown in the upper-level optimization. This is based on the fact that in the upper optimization, X contains at least part of the target pattern when ((4) * O. Additionally, although constraints are imposed on both the triggers and the target pattern, the constraint on the target pattern does not actively participate in the optimization process. Instead, it serves as constraint that the attacker is expected to adhere to when determining the shape of the target pattern.
3.2 BACKTIME Algorithm
To successfully achieve backdoor attack MTS forecasting, need to determine three key elements: (RQ1) where to attack, i.e., identifying which variable to target: (RQ2) when to attack, i.c., selecting which timestamps to attack; and (RQ3) how to attack, i.e., specifying the trigger inject. Regarding (RQ1) where to attack, as outlined in Problem [ the target variables are determined by the attacker and can be any variable desired. Subsequently, we will discuss (RQ2) when to attack in Section
3.2.1 and provide the details of (RQ3) how to attack in Sections 3.2.2 and 3.2.3
3.2.1
Selecting Timestamps for Poisoning
In this section, we design an illustrative experiment to investigate the properties of the timestamps that are more susceptible to attack. The main idea of the experiment is, given a simple and weak backdoor attack, to observe the change of attack effect when choosing timestamps with different properties for attack. Based on the experiment results, we find that timestamps w.r.t. high prediction errors for a clean model are more susceptible attacks.
We investigate the properties of timestamps on the PEMS03 dataset. Specifically, we first train a forecasting model (i.e., clean model fCLB) on the original dataset X and record the Mean Absolute Error (MAF) of the predictions for each timestamp. performance for that timestamp. We then sort the timestamps in ascending order based on their MAE and divide them into ten groups, with average MAE percentiles of 0.05, 0.15, .... 0.95, as shown on the x-axis of Figure 2 Then, for each group, we implement simple backdoor attack, where a shape-fixed trigger and target pattern are injected to all the timestamps and variables within the timestamp group, and train new model (i.e., attacked model fATX) the poisoned data ATK
higher MAE indicates poorer prediction
5

---

The shapes of the trigger and the target pattern are shown in Appendix D Intuitively, a timestamp i, that is suscepti- ble to backdoor attack will have a low poisoned MAF, i.e., MAE( XATKK predictions of the attacked model can be greatly altered by the attack to fit the target pattem. However, relying solely on poisoned MAE is insufficient because if the target pat- tern closely resembles the ground truth, the poisoned MAE will still be low even if the attack fails. To address this problem, we test a clean model on the poisoned dataset and further record its clean MAF for each poisoned times- tamp f, i.e., MAE XAT, X ) Then, a lower MAE difference between poisoned MAE and clean MAE can reliably indicate more vulnerable timestamps, since the clean MAE will be quite low, leading to high MAE differ- ence, when the target pattemn is similar to the ground truth. The experiment results, as shown in Figure 2 demonstrate that the group with higher MAE percentile can continu- ously lead to a lower MAE difference. These findings imply that timestamps where a clean model performs poorly are more susceptible to backdoor attacks. Therefore, to ensure the strength of backdoor attack, for each timestamp t, we leverage pretrained clean model to calculate MAE between predictions and the ground truth Xt,.f, and further select the top an timestamps with the highest MAE, denoted as T
18
MAE Difference
16
1i,h: (.,)). It means that at timestamp 4, the
14
12
0000
0.05
0.15
0.25
0.35
0.45
0.85
0.65
0.75
0.85
0.95
Mean MAE Percentile of Groups
Figure 2: The difference of MAE be-
tween a clean model and attacked model when using different timestamps for attack. A lower MAE difference (y- axis) indicates more susceptible times- tamps to attack.
3.2.2 Trigger Generation
Once the poisoned timestamps are determined, the next step is to generate adaptive triggers to poison the dataset. First, we generate a weighted graph by leveraging an MLP to capture the inter- variiblee correlation within the target variables S. Then, we further utilize a Graph Convolutional Network (GCN) 40) for trigger generation based on the learned weighted graph.
Graph structure generation. Since aim activate backdoor in any timestamps, we do not expect that the generated graph is closely related to specific local temporal properties in the training set. Thus, we focus on building a static graph by learning the global temporal features within the target variables S. Motivated by this goal, we take as the entire input time series data x,, i E S instead of using sliced time windows. However, the time span T of time series data is often very large, and hence it is inefficient to directly use total data without preprocessing. Therefore, we apply the discrete Fourier transform (DFT) [54] to effectively reduce the dimension while maintaining useful information. Intuitively, long-time-scale features, such as trends and periodicity, play a pivotal role in the global temporal correlation among variables, compared with the local noise or high-frequency fluctuations. Consequently, after DFT, we retain only the low-frequency features of the time series data. Mathematically, for any target variable E S, this transform could be expressed as z, Filter(DFFT k) where DFT(-) represents the DFT transformation. and Filter(-, k) represents preserving the top low-frequency features. Furthermore, we employ Multilayer Perceptron (MLP) to adaptively learn features of different frequencies. Subsequently, we utilize the output of the MLP to construct a graph that measures the correlation between target variables. The aforementioned process can be expressed as:
Aij cMs( (z;), MLP(z,)), i,j S
where Ai, represents the element of learned graph A at the i-th row and the j-th column, and cos(;.) represents the cosine similarity.
Adaptive trigger generation. Once a correlation graph has been obtained, our objective shifts to the generation of learnable triggers that can be seamlessly integrated into various models with efficacy and imperceptibility. To ensure semantic consistency between triggers and historical data, we employ time window with length of (EE to slice the historical data preceding the trigger. Then, we utilize a GCN for trigger generation based on the sliced historical data:
gr. = GCN( ATK SEF
TGR f. - TGR .S. A), Vt, E 7
(5)
In experiments, we find the following phenomenon: the GCN intends to aggressively increase the amplitude of output ~t.. Even if an extra penalty on the amplitude is introduced, it still requires

---

much effort to adjust the hyperparameters to control the trigger amplitude. One potential explanation for this behavior is that a large trigger amplitude leads substantial deviation, and data points characterized by such deviations are more readily learned by forecasting models although they violate the requirements of stealthiness. To address this issue, we propose to introduce a non-linear scaling function, (-n) to generate stealthy triggers by imposing mandatory limitations on the amplitude of outputs St, Mathematically, the generated triggers can be formalized as follows:
gt: = = TOR tanh(He)) Vt, E T
3.2.3 Bi-level Optimization
After introducing the model architecture of the adaptive trigger generator fg in Eqs. and (6) we aim to optimize the trigger generator through bi-level optimization problem in Eq. (3) ensure the effectiveness of the generated triggers. Recognizing the inherent complexity of bi-level optimization, we introduce surrogate forecasting model f. to provide a practical approximation of the precise solution. This allows us to solve Eq. (3) by iteratively updating the surrogate model and the trigger generator. However, we further find that if we randomly initialize the surrogate model fs. then the performance of the trigger generator tends to fluctuates in the initial stage, posing a significant difficulty in convergence. Therefore, introduce an additional warm-up phase. During the warm-up phase, we only train the surrogate model to make it have a reasonable forecasting ability. Once the warm-up phase is over, we will update both the surrogate model and trigger generator. Specifically, in this phase, we will divide the training process for each epoch into two stages: (1) the surrogate model update, and (2) the trigger generator update.
At the first stage, we poison the clean dataset, mentioned in Section 2.3 Then aim to improve the forecasting ability of the surrogate model the poisoned dataset X Specifi- cally, we employ natural forecasting loss func- tion, denoted as Lax, to update the surrogate model fs while fixing the parameters of the trig- ger generator fgi
Algorithm 1: BBAKТTМE
Input :A MTS dataset X, a surrogate
forecasting model f., a trigger generator fg. a temporal injection rate and set of target variables S
Output :A poisoned dataset A Initialize T as the set timestamps in X // Warm-up phase
letn LoLx (Js (XATK)
ET
Train f. on X for epochwarm epochs
(7)
In this paper, we use smooth L1 loss 36 as the
// Selecting poisoned timestamps
3 $t, < MA X.,,). Vt, E T;
forecasting loss LaIN-
T + top ar timestamps with highest st
As for the second stage, we aim to update the trigger generator fg for effective and unnotice- able triggers. Following Section 2.3 for each poisoned timestamp t; E T we will utilize the trigger generator fg obtain the trigger St. based on Eqs (5) and (6). and then re-inject those triggers to obtain the poisoned dataset ATT The main difference of trigger injection between 10 return A this stage and the first stage is that the gradient
// Bi-level training phase
5 for epoch = 1 - epochtraan do
Update 9s, w.r.t. Eq. (6) and get X ATT,
7 Update fa w.r.t. Eq. (7):
Update Sg w.r.t. Eqs.
and 10)
Update 9t, w.r.t. Eq. (6) and get ATI,
a* here would be preserved. Then, we aim to implement the attack loss in Eq. to ensure the By. effectiveness of triggers. Specifically, after fixing the parameter of the surrogate model Ss, the attack loss could be formalized as:
2TH
lack Σ
LATR (fo (XATR,
X
(tts). Vt T
(8)
In the paper, set 17(2)= for simplicity, and set LATX as the MSE loss.
Furthermore, we introduce normalization loss to regulate the shape of triggers, thereby enhancing their stealthiness. The main intuition is that fig-frreyeeccy fluctuations or noises widely exist in
MTS data of real-world datasets (35,, but the bi-level optimization Eq. (3) does not inherently guarantee that triggers will have high frequuryyynccy signals. Therefore, to bridge this gap, the following
7

---

normalization loss is introduced:
paR Σ 9 [2.
norm AVG
vt, T
where A) represents the average operation. The key idea is that triggers will exhibit alternating positive and negative components, i.e., fluctuations, if the summation of triggers along the temporal dimension approaches zero. To sum up, the loss function for the trigger generator in the second stage can be expressed as:
legr latk + hoorm Vt E T
(10)
where À is hyperparameter. All the above training procedures are summarized in Algorithm
4 Experiments
Table 2: Main results of backdoor attack on MTS forecasting. For all the metrics, the lower the better.
Bold font indicates the best performance for the attack effectiveness. Due to space limitation, report the key performance results averaged over three MTS forecasting models and omit some minor
detailed values. Please refer Appendix E for full results.
Clean
Random MAFc
Inverse
Manhatton MAFe
ВACKTIME
Dataset
Model
MAFe
MAFA
MAFA
MAFe
MAFA
MAFA
MAEC
MAF
TimesNet
20.00
28.63
20.92
29.30
20.03
26.62
19.89
26.33
21.23
20.83
FEDformer
15.78
39.86
16.14
15.70
16.18
16.05
16.42
17.10
16,34
14.05
PEMS03
Autoformer
16.03
38.38
17.09
20.98
17.23
20.55
16.75
22.13
17.12
17.68
Average
17.27
35.62
18.05
21.99
17.81
21.07
17.69
21.85
18.23
17.52
PEMS04
Average
24.34
46.82
21.50
30.01
22.61
26.17
22.69
30.95
22.60
26.17
PEMS08
Average
19.30
40.66
19.81
34.69
20.09
30.39
20.37
24.47
19.67
21.48
Weather
Average
12.75
94.43
14.53
23.76
13.67
65.56
15.54
73.88
8.43
15.49
ETTml
Average
1.25
2.58
1.28
1.59
1.32
1.53
1.28
1.82
1.14
1.41
Table 3: Attack performance on the PEMS03 dataset when using different shapes of target patterns. Bold font indicates the best performance for natural forecasting and attacked forecasting, and underlined number indicates the second best.
Methods
Cone
Upward trend MAE
Up and down
RMSEA
RMSEA
MAEE
RMSL.
MAEA
RMSEA
Cleun 20.00
34.18
28.63
46.69
20.11
34.27
29.32
47.21
19.50
33.78
33.09
50.52
Random
20.92
34,02
29.30
47.07
19.86
33,99
31.41
48.74
19.21
33,31
33.90
51.42
Inverse 20.03
34.21
26.62
38. 20
19.91
34.07
30.12
41.44
19.89
34.03
23.14
33.34
Manhattan
19.89
34.05
26.33
36.50
20.17
34.53
24:70
34. 14
19
33.63
29.88
40.28
BACKTIME
30.94
32.15
20.14
31.16
Datasets, We conduct experiments five real-world datasets, including PEMS03 663 PEMS04 63
PEMS08 (63), weather [2] and ETTml [81]. The detailed information of these datasets are provided in Appendix For each dataset, use the same 60%/22%%/00% splits for train/validationntes sets.
Experiment protocal. For the basic setting of backdoor attacks, we adopt TOR and PPT 7, with 4n of 0.03 and ag of 0.3. More details of attack settings are provided in Appendix C.2 Following prior studies [4 21 [5)
we use the past 12 time steps to predict subsequent time steps. We compare BACKTIME with four different training strategies (Clean, Random, Inverse, and Manhaftan) and three SOTA forecasting models 82 69
under all possible combinations to fully validate BACKTIME's effectiveness and versatility. More details of these forecasting models are provided in Appendix C.T As for the baselines, Clean trains forecasting models on clean datasets. Random randomly generates triggers from uniform distribution. Inverse uses pre-trained model to forecast the sequence before the target pattern, using it as triggers. Manhattan finds the sequence with the smallest Manhattan distance the target pattern and uses preceding data as triggers. Detailed respectively. Metrics. To evaluate the natural forecasting ability, we use Mean Absolute Error (MAE) and Root Mean Squared Error (RMSE) between the model's output and the ground truth when the input clean, denoted as MAE and RMSEC. respectively. To evaluate attack effectiveness, we use MAE and RMSE between the model's 's output and the target pattern when the input contains triggers, denoted as MAEA and RMSEA, respectively. For all these metries, the lower, the better.
implementations for BACKTIME and baselines are provided Appendices C.2 and C33

---

Table 4: Results of detecting modified segments of poisoned datasets by anomaly detection methods.
PEMS03
PEMS04
PEMSOS
Weather
ETTml
Anomaly Detection
F1 Fl-score
AUC
F1 soooe
AUC
Fl score
AUC
F1-score
ACC
Fi-score
AUC
GDN USAD
0,5006
0,5448
0.4971 0.0000
0.5270
0.4986
0,5331
0,6015
0.6450
0.4970
0.5365
0.0000
0,5147
0,5183
0.0668
0.4980
0.0000
0,5389
0,0000
0.5279
17.3
12.3
doon
polson
0101
polson
12.5
12.0
15.5
04:13
140
PC301
pc021
Tempored tejection Rate
Terpood Injection Rode
Opetell Iejection Rate
Spstiel lngection Rate
Figure 3: The impact of the temporal injection rate and the spatial injection rate dg on clean metries, MAEC and RMSEC, and attack metrics, MAE, and RMSEA
Effectiveness evaluation. We assess BACKTIME's effectiveness on three different target patterns, detailed in Appendix D Tablo the main results for natural forecasting ability (MAEc) and attack effectiveness (MAFs) with a cone-shaped target pattern. Note that only for the Clean row, MAEA and RMSEA are calculated with clean inputs. Similar results for different target patterns, where we poison PEMS03 with FEDformer [22 (the surrogate model) and test on TimesNet [69], in Table Each experiment is repeated three times with different random seeds, and the mean metrics are reported. Regarding the attack effectiveness, BACKTIME achieves lowest average MAEA among all the datasets and baselines. It also continuously reduces MAEA low degree for all the model architectures and datasets compared with clean training, indicating a strong effectiveness and versatility of BACKTIME. Specifically, on the five dataset, MAEA decrease on average by 50.8%. 44.10% 52.6 52.44%, 83.52% and 45. 45.40%. respectively. Mcanwhile, BACK can also maintain competitive models' natural forecasting ability. For example, on the PEMS08, Weather and ETTml datasets, models attacked by BACKTIME exhibit similar or even better forecasting performance than the clean training. In short, BACKTTIME performs effective and versatile backdoor attacks across different model architectures, while still keeping models' competitive forecasting ability.
Stealthiness evaluation. To verify that the data modifications of BACKTIME are imperceptible, we employ anomaly detection methods, GDN [6 and USAD 4. to identify the poisoned time slots. Specifically, for each dataset, train anomaly detection methods on the clean test set and then record the Fl-score and the Area under the ROC Curve (ROC-AUC) on the poisoned training set. The experimental results are presented Table 4 The results show that, across all datasets, ROC-AUC is around 0.5 and FI FI-score is either around 0.5 or near O, suggesting that the detection results are nearly close to that of random guess. These strongly demonstrates the stealthiness of BACKTTME.
A Ablation study. To investigate the impact of injection rates on the attack effectiveness, we conduct experiments on the PEMS03 dataset, with different temporal and spatial injection rates. The experi- mental results are shown in Figure 3 Based on the results, as the temporal injection rate or increases, decreasing MAE and RMSEA imply that the effect of BACKTIME gradually improves. However, even when OT = 0.015, BACKTIME still implements an effective attack. On the other hand, as the spatial injection rate Og increases, the effect of BACKTIME first improves and then decreases. This phenomenon may be due to the combined effects of two factors. First, an increase in ag leads to more poisoned data, which reduces the difficulty of backdoor attack. Second, an increase ag leads to an increasing number of target variables, making the correlations among target variables more complicated and harder to learn. It increases the attack difficulty. Nonetheless, under all injection rates shown in Figure 3 BACK successfully achieves the attack, demonstrating its superiority.
5 Related Work
Multivariate time series forecasting. Recently, many deep learning models have been proposed for MTS forecasting. TCN-based methods [55
23
65
capture temporal dependencies using con- 63] model inter-variable relationships in excel in MTS forecasting by using attention
volutional kernels. GNN- based methods B3
79
spatio-temporal graphs. Transformers [69 mechanisms capture temporal dependencies and inter-variable correlations.
81
82
49
Adversarial attack on times series forecasting, Recently, research on adversarial attacks in time series forecasting has emerged. Pialla et al. [56] propose adversarial smooth perturbation by

---

adding a smoothness penalty to the BIM attack [41] Dang et al. [14 use Monte-Carlo estimation to attack deep probabilistic autoregressive models. Wu al. 70 generate adversarial time series through slight perturbations based on importance measurements. Mode et al. [22 employ BIM
to target deep learning regression models. Xu et al. 71 use a gradient-based method to create imperceptible perturbations that degrade forecasting performance.
Backdoor attacks. Existing backdoor attacks aim to optimize triggers for effectiveness and stealthi- ness. Extensive works focus on designing special triggers, such as a single pixel [6], black-and-
white checkerboard 28 mixed backgrounds [TO], natural reflections [50], invisible noise [46], and
adversarial patterns 80 67 On time series classification, TimeTrooon [88 employs random noise
as static triggers and adversarial perturbations as dynamic triggers, demonstrating that both types of triggers can successfully execute backdoor attacks. Jiang et al. (38] generate triggers that are as realistic as real-time series patterns for stealthy and effective attack.
Future Directions And Potential Defenses
Backdoor attacks on Multivariate Time Series (MTS) represent novel area of research, presenting numerous promising avenues for both attack and defense. In terms of attacks, beyond pursuing stealthier and more efficient triggers, there are several intriguing challenges that BACKTIME does not address.
First, attacking MTS imputation tasks remains unexplored and is difficult for BACK TIME tackle. To achieve an effective backdoor attack, BACKTTIME concatenates the trigger and target pattern sequentially establish strong temporal association, which is the foundation of its attack effec- tiveness. However, in time series imputation tasks, deep learning models infer missing values based on both preceding and subsequent data. This dual-direction inference reduces reliance on the data preceding the missing values, thus breaking BACKTIME's core assumption. Therefore, designing triggers that can influence both future and past data could be interesting direction explore.
Second, backdoor attacks on MTS forecasting with missing values pose a significant challenge. BACKTIME's attack depends the inclusion of complete trigger in the input predict the target pattern. If the trigger is incomplete due to missing values, the attacked model might fail to recognize the trigger, rendering the backdoor attack ineffective. Hence, it would be highly interesting to design triggers that remain effective even when only partial triggers are included.
In terms of backdoor defense, detecting triggers in MTS is an intriguing problem and we provide some potential solutions here. First, there may be a frequency difference between the generated triggers and the real data. Therefore, detecting distribution shifts in the frequency domain could be promising approach. Additionally, the generated triggers may lack the diversity present in real- world data. As result, in the feature space, the (trigger, target patter) pairs might cluster closely together, making it fcasible to detect backdoor attacks using clustering algorithms.
Conclusion
In this paper, we study backdoor attacks in multivariate time series (MTS) forecasting. On this novel problem setting, we identify two main properties of backdoor attacks: stealthiness and sparsity, and further provide a detailed threat model. Based on this, we propose a new bi-level optimization problem, which serves general framework for backdoor attacks in MTS forecasting. Subsequently, we introduce BACKTIME, which utilizes a GNN-based trigger generator and a surrogate forecasting model to generate effective and stealthy triggers by iteratively solving the bi-level optimization. Extensive experiments on five real-world datasets demonstrate the effectiveness, versatility, and stealthiness of BACKTIME attacks.
Acknowledgement
This work is supported by NSF (2116770) ). NIFA (2020-67011-32799), and IBM-IIlinois Discovery Accelerator Institute. The content of the information this document does not necessarily reflect the position or the policy of the Government, and no official endorsement should be inferred. The U.S. Government is authorized to reproduce and distribute reprints for Government purposes notwithstanding any copyright notation here on.
10

---

References
[1] Project green
[2] Wetterstation. the weather dataset. https://wwwt htw.:/a.....jj................ det.tt.eeeeee///////
[3] Hossein Abbasimehr and Reza Paki. Improving time series forecasting using 1stm and attention models, Journal of Ambient Intelligence and Humanized Computing, 13(1):673-66 691,, 2022.
[4] Julien Audibert, Pietro Michiardi, Frédéric Guyard, Sébastien Marti, and Maria A Zuluaga. Usad: Unsupervised anomaly detection on multivariate time series. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 3395-3404, 2020.
[5] Lei Bai, Lina Yao, Can Li, Xianzhi Wang, and Can Wang. Adaptive graph convolutional recurrent network for traffic forecasting. Advances in neural information processing systems, 33:17804-17811 2020.
[6] Yikun Ban, Yuchen Yan, Arindam Banerjee, and Jingrui He. Ee-net: Exploiatiion-exploation neural networks in contextual bandits. arXiv preprint arXiv:21 2021.
[7] MR Bendre, RC Thool, and VR Thool. Big data in precision agriculture: Weather forecasting for future farming. In 2015 1st international conference on next generation computing technologies (NGCT), pages 744-750, IEEE, 2015.
[8] Jiasheng Cao and Jinghan Wang. Stock price forecasting model based on modified convolution neural network and financial time series analysis. International Journal of Communication Systems, 32(12):33987, 2019.
[9] Minghao Chen, Houwen Peng, Jianlong Fu, and Haibin Ling, Autoformer: Searching trans- formers for visual recogmition. In Proceedings of the IEEE/CVF international conference on computer vision, pages 2270-122820 2021.
[10] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint 1rXiv:1712.055226 2017.
[11] Weilin Cong, Jian Kang, Hanghang Tong, and Mchrdad Mahdavi. On the generalization capability of temporal graph learning algorithms: Theoretical insights and a simpler method. arXiv preprint arXiv:2402.16338 2024.
[12] Weilin Cong. Si Zhang, Jian Kang, Baichuan Yuan, Hao Wu, Xin Zhou, Hanghang Tong, and Mehrdad Mahdavi. Do we really need complicated model architectures for temporal networks? arXiv preprint arXiv:2302.1 110.: 2023.
[13] Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. A backdoor attack against Istm-based text classification systems. IEEE Access, 7: 7:138872-138878, 2019.
[14] Raphaël Dang-Nhu, Gagandeep Singh, Pavol Bielik, and Martin Vechev. Adversarial attacks on probabilistic autoregressive forecasting models. In International Conference on Machine Learning, pages 2356-2365 2365. PMLR, 2020.
[15] Philemon Manliura Datilo, Zuhaimy Ismail, and Jayeola Dare. A review of epidemic forecasting using artificial neural networks. Epidemiology and Health System Journal, 6(3):322-443, 2019.
[16] Ailin Deng and Bryan Hooi. Graph neural network- anomaly detection in multivariate time series. Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 4027-4035, 2021.
[17] Angel Desai, Moritz UG Kraemer, Sangeeta Bhatia, Anne Cori, Pierre Nouvellet, Mark Herringer, Emily I. Cohn, Malwina Carrion, John S Brownstein, Lawrence C. Madoff, et al. Real-time epidemic forecasting: challenges and opportunities. Health security, 17(4):268-775 2019.

---

[18] Daizong Ding, Mi Zhang, Yuanmin Huang, Xudong Pan, Fuli Feng, Erling Jiang, and Min Yang. Towards backdoor attack on deep learning based time series classification. In 2022 IEEE 38th International Conference on Data Engineering (ICDE), pages 1274-1287. IEEE, 2022.
[19] Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems, 34: 1 18944-18957, 2021.
[20] Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11966-119766 2021.
[21] Zheng Fang, Qingqing Long, Guojie Song, and Kunqing Xie. Spatial-temporal graph ode networks for traffic flow forecasting. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages 364-373, 2021.
[22] Le Feng, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Stealthy backdoor attack with adversarial training. In ICASSP 2022-2022 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pages 2969-2973, IEEE, 2022.
[23] Jean-Yve Franceschi, Aymeric Dieuleveut, and Martin Jaggi. Unsupervised scalable represen- tation learning for multivariate time series, Advances in neural information processing systems, 32, 2019.
[24] Dongqi Fu, Liri Fang, Ross Maciejewski, Vetle I. Torvik, and Jingrui He. Meta-learned metries over multi-evolution temporal graphs. In KDD '22: The 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Washington, DC, USA, August 14 18, 2022, pages 367-377, ACM, 2022.
[25] Dongqi Fu, Zhigang Hua, Yan Xie, Jin Fang. Si Zhang, Kaan Sancak, Hao Wu, Andrey Malevich, Jingrui He, and Bo Long. Ver-graphormer: A mini-batch graph transformer via virtual connections. CoRR, abs/2403. 16000, 2024.
[26] Dongqi Fu, Dawei Zhou, and Jingrui He. Local motif clustering time-evolving graphs. In KDD '20: The 26th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Virtual Event, CA, USA, August 23-27, 2020, pages 390 400. ACM, 2020.
[27] Dongqi Fu, Yada Zhu, Hanghang Tong, Kommy Weldemariam, Onkar Bhardwaj. and Jingrui He. Generating fine-grained causality in climate time series data for forecasting and anomaly detection. CoRR, abs/2408. .02554, 2024.
[28] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXin: 2017.
[29] Shengnan Guo, Youfang Lin, Huaiyu Wan, Xiucheng Li, and Gao Cong. Learning dynamics and heterogeneity of spatial-temporal graph data for traffic forecasting. IEEE Transactions on Knowledge and Data Engineering. 34(1 1:445-55428, 2021.
[30] Yoo-Geun Ham, Jeong- Hwan Kim, Eun-Sol Kim, and Kyoung-Wai Woon On. Unified deep learning model for el niño/southern oscillation forecasts by incorporating seasonality in climate data. Science Bulletin, 66( (6(13):110 1ee1111881366 2021.
[31] Haoyu Han, Mengdi Zhang, Min Hou, Fuzheng Zhang, Zhongyuan Wang, Enhong Chen, Hongwei Wang, Jianhui Ma, and Qi Liu. Stgen: a spatial-temporal aware graph learning method for poi recommendation. In 2020 IEEE International Conference on Data Mining (ICDM), pages 1052-1057. IEEE, 2020.
[32] James W Hansen, Simon J Mason, Liqiang Sun, and Arame Tall. Review of seasonal climate forecasting for agriculture in sub-saharan africa. Experimental agriculture, 47(2):205- 2011.
[33] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
12

---

[34] Hansika Hewamalage, Christoph Bergmeir, and Kasun Bandara. Recurrent neural networks for time series forecasting: Current status and future directions. International Journal of Forecasting, 37(1):388-47) 2021.
[35] Qihe Huang, Lei Shen, Ruixin Zhang, Shouhong Ding, Binwu Wang, Zhengyang Zhou, and Yang Wang. Crossgnm: Confronting noisy multivariate time series via cross interaction refine- ment. Advances in Neural Information Processing Systems, 36, 2024.
[36] Peter J Huber. Robust estimation of location parameter. In Breakthroughs in statistics: Methodology and distribution, pages 492-518. Springer, 1992.
[37] Weiwei Jiang and Jiayun Luo. Graph neural network for traffic forecasting: A survey, Expert Systems with Applications, 207:1 17221, 2022.
[38] Yujing Jiang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Backdoor attacks on time series: A generative approach. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 392-403. IEEE, 2023.
[39] Baoyu Jing. Hanghang Tong, and Yada Zhu. Network of tensor time series. In Proceedings of the Web Conference 2021, pages 2425-2437, 2021.
[40] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. arXiv preprint
2016.
[41] Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pages 112. Chapman and Hall/CRC. 2018.
[42] Koichi Kurumatani. Time series forecasting of agricultural product prices based on recurrent neural networks and its evaluation method. SN Applied Sciences, 2(8):1434, 2020.
[43] Hyun Kwon and Sanghyun Lee. Textual backdoor attack for the text classification system. Security and Communication Networks, 2021:1-11, 2021.
[44] Shiyong Lan, Yitong Ma, Weikang Huang, Wenwu Wang. Hongyu Yang, and Pyang Li. Dstagnn: Dynamic spatial-tempe temporal aware graph neural network for traffic flow forecasting. In Interna- tional conference on machine learning, pages 1 1906-11917. PMLR, 2022.
[45] Ibai Lana, Javier Del Ser, Manuel Velez, and Eleni Vlahogianni. Road traffic forecasting: Recent advances and new challenges. IEEE Intelligent Transportation Systems Magazine, 10(2):93-109, 2018
[46] Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. Backdoor em- bedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv:1808 10307, 2018
[47] Xiao Lin, Jian Kang, Weilin Cong, and Hanghang Tong. Bemap: Balanced message passing for fair graph neural network. Learning on Graphs Conference, pages 37-1. PMLR, 2024.
[48] Linbo Liu, Youngsuk Park, Trong Nghia Hoang. Hilaf Hasson, and Jun Huan. Robust multi- variate seme-series forecasting: adversarial attacks and defense mechanisms. arXiv preprint arXiv:2207.0957. 2022.
[49] Yong Liu, Haixu Wu, Jianmin Wang, and Mingsheng Long. Non-stationary transformers: Exploring the stationarity in time series forecasting. Advances in Neural Information Processing Systems, 35:9881-9899, 2022.
[50] Yunfei Liu, Xingjun Ma. James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part X 16, pages 182-199. Springer, 2020.
[51] Abdul Quadir Md, Sanjit Kapoor, Chris Junni AV, Arun Kumar Sivaraman, Kong Fah Tee, Sabireen, and N Janakiraman. Novel optimization approach for stock price forecasting using multi-layered sequential Istm. Applied Soft Computing, 134:109830 2023.
13

---

[52] Gautam Raj Mode and Khaza Anuarul Hoque. Adversarial examples in deep learning for multi- variate time series regression. 2020 IEEE Applied Imagery Pattern Recognition Workshop (AIPR), pages 1-10. IEER, 2020.
[53] Yuqi Nie, Nam H Nguyen, Phanwadee Sinthong, and Jayant Kalagnanam. A time series is worth 64 words: Long-term forecasting with transformers. arXiv preprint arX4w:2211.14730, 2022.
[54] Alan V Oppenheim. Discrete-time signal processing. Pearson Education India, 1999.
[55] Ashutosh Pandey and DeL.iang Wang. Tenn: Temporal convolutional neural network for real-time speech enhancement in the time domain. In ICASSP 2019-2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 6875-6879. IEEE, 2019.
[56] Gautier Pialla, Hassan Ismail Fawaz, Maxime Devanne, Jonathan Weber, Lhassane Idoumghar, Pierre-Alain Muller, Christoph Bergmeir, Daniel F Schmidt, Geoffrey I Webb, and Germain Forestier. Time series adversarial attacks: an investigation of smooth perturbations and defense approaches. International Journal of Data Science and Analytics, pages 1-11, 2023.
[57] Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. Mind the style of text! adversarial and backdoor attacks based on text style transfer. arXiv preprint arXiv:21 / 10.07139. 2021.
[58] Yunzhe Qi, Yikun Ban, and Jingrui He. Graph neural bandits. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1920-1931, 2023.
[59] Jim Salinger, AJ Hobday, RJ Matear, TJ O' O'Kane, JS Risbey, Piers Dunstan, JP Eveson, EA Ful- ton, M Feng, EE Plaganyi, et al. Decadal-scale forecasting of climate drivers for marine applications. Advances in Marine Biology, 74:1-68 68, 2016.
[60] Sebastian Scher. Toward data-driven weather and climate forecasting:
Approximating simple general circulation model with deep learning. Geophysical Research Letters, 42(22):12-616, 2018.
[61] Tej Bahadur Shahi, Ashish Shrestha, Arjun Neupane, and William Guo. Stock price forecasting 2020.
with deep learning: A comparative study. Mathematics,
[62] Qi Shao, Wei Li, Guijun Han, Guangchao Hou, Siyuan Liu, Yantian Gong, and Ping Qu. A deep learning model for forecasting sea surface height anomalies and temperatures in the south china sea. Journal of Geophysical Research: Oceans, 126(7))e0021J0017515 2021.
[63] Chao Song. Youfang Lin, Shengnan Guo, and Huaiyu Wan. Spatial-temporal synchronous graph convolutional networks: A new framework for spatial-temporal network data forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 914-921, 2020.
[64] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
[65] Renzhuo Wan, Shuping Mei, Jun Wang, Min Liu, and Fan Yang. Multivariate temporal convolutional network: A deep neural networks approach for multivariate time series forecasting. Electronics, 8(8):876, 2019.
[66] Lijing Wang, Jiangzhuo Chen, and Madhav Marathe. Defsi: Deep learning based epidemic forecasting with synthetic information. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 9607-9612, 2019.
[67] Tong Wang, Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang. An invisible black-box backdoor attack through frequency domain. In European Conference on Computer Vision, pages 396-113. Springer, 2022.
[68] Yisen Wang et al. Made: Graph backdoor defense with masked unlearning. arXiv preprint 241842241, 2024.
14

---

[69] Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. In The eleventh international conference on learning representations, 2022.
[70] Tao Wu, Xuechun Wang, Shaojie Qiao, Xingping Xian, Yanbing Liu, and Liang Zhang. Small perturbations are enough: Adversarial attacks on time series prediction. Information Sciences, 587:794-81 812, 2022.
[71] Aidong Xu, Xuechun Wang, Yunan Zhang, Tao Wu, and Xingping Xian. Adversarial attacks on deep neural networks for time series prediction. In 2021 10th International Conference on Internet Computing for Science and Engineering, pages 8-14, 2021.
[72]
Yoo and Il-Seok Oh. Time series forecasting of agricultural products' sales volumes based on seasonal long short-term memory. Applied sciences, 10(22):8169, 2020.
[73] Kyung Keun Yun, Sang Won Yoon, and Daehan Won. Interpretable stock price forecasting model using genetic bigorithh--mcching learning regressions and best feature subset selection. Expert Systems with Applications, 213: 113::18800 18803,, 2023.
[74] Zhichen Zeng, Ruizhong Qiu, Zhe Xu, Zhining Liu, Yuchen Yan, Tianxin Wei, Lei Ying, Jingrui He, and Hanghang Tong. Graph mixup on approximate gromov-wasserstinn geodesics. In forty-first International Conference Machine Learning.
[75] Zhichen Zeng, Si Zhang, Yinglong Xia, and Hanghang Tong. Parrot: Position-aware regularized optimal transport for network alignment. In Proceedings of the ACM Web Conference 2023, pages 372-382, 2023.
[76] Zhichen Zeng, Ruike Zhu, Yinglong Xia, Hanqing Zeng, and Hanghang Tong. Generative graph dictionary learning. In International Conference Machine Learning, pages 40749-40769. PMI.R, 2023.
[77] Chaoyun Zhang and Paul Patras. Long-term mobile traffic forecasting using deep spatio- temporal neural networks. In Proceedings the Eighteenth ACM International Symposium Mobile Ad Hoc Networking and Computing, pages 231-240, 2018.
[78] Chuanjun Zhao, Meiling Wu, Jingfeng Liu, Zening Duan, Lihua Shen, Xuekui Shangguan, Donghang Liu, Yanjie Wang. et al. Progress and prospects of data-driven stock price forecasting research. International Journal of Cognitive Computing in Engineering, 4: 1000-000 2023.
[79] Ling Zhao, Yujiao Song, Chao Zhang, Yu Liu, Pu Wang, Tao Lin, Min Deng, and Haifeng Li T-gen: A temporal graph convolutional network for traffic prediction. IEEE transactions on intelligent transportation systems, 21(9):3848-3855 2019.
[80] Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on vidco recognition models. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 14443-14452, 2020.
[81] Haoyi Zhou, Shanghang Zhang, Jieqi Peng. Shuai Zhang. Jianxin Li, Hui Xiong, and Wancai Zhang. Informer: Beyond efficient transformer for long sequence time-series forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pages 11106-11115, 2021.
[82] Tian Zhou, Ziqing Ma, Qingsong Wen, Xue Wang. Liang Sun, and Rong Jin. Fedformer: Frequency enhanced decomposed transformer for long-term series forecasting. International conference on machine learning, pages 27268-27286. PMLR, 2022.
15

---

A Key Symbols of BACKTIME
Table 5: Key symbols.
Symbol
Definition
f tIB gour T
The timestamps
The length of time windows
The prediction time steps
The time span
The number of variables
k
The number of selected low-frequency features
Orr
The temporal injection rate
Og
The spatial injection rate
TOR
The budget for the trigger
PTU
The budget for the target pattern The length of triggers within X The length of target patterns within X
TGR
PTN
X;
The time series sequence of the i-th variable The low-frequeng features of X; after DFT
9
The trigger
The target pattern
A
The learned graph
The clean MTS dataset
X
The historical data in X at the timestamp t,
X
X
f/ tt tOUr
The future data in X at the timestamp &;
The poisoned MTS dataset
X
X
[t; TH tzl
The historical data in X at the timestamp t,
X
[1 14 Y0UT
The future data in X at the timestamp 4;
S
The set of target variables to be attacked The set of all the timestamps The set of the timestamps to be attacked
T
T ATK
f
The forecasting model The surrogate forecasting model The trigger generator
fg
B Descriptions of Datasets
Table 6: Statistics of datasets
Datasets
Time span
The number variables
PEMS03
26208
358
PEMS04
16992
307
PEMS08
17856
170
Weather
52696
21
ETTml
69680
7
In this paper, we demonstrate the effectiveness of BaCKTIME on five different real-world dataset,
PEMS03 (63]. PEMS04 (63), PEMS08 (63]. Weather (2). and ETTml [8]]. The statistics of datasets are provided Table and the detailed information is listed below.
PEMS datasets. These datasets are collected by the Caltrans Performance Measurement System(PeMS) in real time every 30 seconds[4]. The traffic data are aggregated into minutes intervals, which means there are 288 time steps in the traffic flow for one day. The
16

---

system has more than 39,000 detectors deployed on the highway in the major metropolitan areas California. There are three kinds of traffic measurements contained in the raw data, including traffic flow, average speed, and average occupancy.
Weather dataset. This dataset contains local climatological data for nearly 1,600 U.S. locations, years from 2010 2013, where data points are collected every hour. Each data point consists of the target value "wet bulb" and 11 climate features.
ETTml dataset. The ETT is a crucial indicator in the electric power long-term deployment. We collected 2-year data from separated counties in China. The ETTml data is collected for 15-minute-levw Each data point consists of the target value "oil temperature" and power load features.
C Experiment Protocol
C.1 Forecasting Models
To validate that BACKTIME model-agnostic, we train three state-of-the-art forecasting models, including TimesNet [69]. FEDformer [82], and Autoformer[9] poisoned datasets. In the experi- ment, for each forecasting model, we use the default hyperparameter settings the released code of corresponding publications I We use Adam optimizer with a learning rate of 0.0002 update these models. These models serve as benchmarks for evaluating the effectiveness and versatility of BACKTIME across different model architectures. More details of these models are provided as follows.
TimesNet [69]. This model discovers the multi- culti-periodiiity adaptively and extract the complex temporal variations from transformed 2D tensors by parameter-efficien inception block.
This model utilizes Fourier transform to develop frequency enhanced Transformer, aiming to enhance the performance and efficiency of Transformer for long-term prediction.
FEDformer 822
Autoformer 19.. By employing Auto-Correlation mechanism based on the series periodicity, this model conducts the dependencies discovery and representation aggregation at the sub-series level, demonstrating progressive decomposition capacities for complex time series.
C.2 Training Settings of BACKTIME
We utilize FEDformer (22 as the surrogate forecasting model for trigger generation. Concerning BACKTIME, we adopt TGR 4, FPT = and BER 6, with the temporal injection rate or being 0.03 and the spatial injection rate being 0.3. We further set k = 200, A 0.2std and T 0.4std for each dataset where std represents the standard deviation of the training set. Moreover, set À = 2, 000 for PEMS03, PEMS04, PEMS08, and Weather datasets, while À == 5 for ETTml dataset. We use 2-layer MLP with the hidden layer of 64 for graph structure generation in Eq. and use 2-layer GCN with the hidden layer of 64 as the backbone of our trigger generator.
C.3 Baseline Methods
We compare BACKTIME with clean training strategy and three different trigger generation methods.
Clean. Models will not be attacked and will be trained on clean datasets.
Random. Timestamps for attack are randomly selected, and the trigger is generated from uniform distribution ranging from TGR A This trigger is repeatedly used each selected timestamp.
Inverse. This attack method flips the dataset along the temporal dimension and further trains "forecasting" model that forecasts the history based on future data. By using the target pattern as input, the outputs of the prediction model are chosen as the trigger. In experiments,
Library
17

---

is used as the forecasting model. Please note that, for this attack method, the amplitude of generated triggers may exceed the trigger constraints, i.e., ATRR
FEDformer [2
Manhattan. This attack method locates time segments in the training set with the smallest Manhattan distance to the target pattern and uses the preceding time series data of those segments triggers. Please note that, for this attack method, the amplitude of generated triggers may exceed the trigger constraints, i.e., A TCR
D Description of Triggers and Target Patterns
Table 7: The value of triggers on the timestamp selection experiment.
Timestamp Trigger
2
3
4
-0.05
0.05
-0.05
0.05
0.35
0.3
0.2
Tareet Pattrr
0.39
Target Putter
0.1
025
0.25
0.00
0.20
-01
0.15
0.15
(a) The cone-shaped larget pat-(b) The target pattern with up-(c) The target pattern with up and down shape
ward trend.
Figure 4: The shapes of all the target patterns we evaluated in this paper.
In Section 3.2.1 we implement a simple and weak backdoor attack for identifying the properties of timestamps that more vulnerable attack. As for the setting of this backdoor attack, we use shape-fixed trigger, whose data are listed in Table and a cone-shaped target pattern, whose data are shown in Figure For each timestamp group, we will inject this trigger and target pattern into every timestamp within the group, thus poisoning 10% timestamps in the training set. The experimental results show that timestamps where a clean model performs poorly are more susceptible backdoor attacks.
In Section patterns. These target patterns will be inserted into datasets with data standardization, and the specific shapes of the three target patterns are equal to, higher than, or lower than their starting points, respectively. Intuitively, flipping the target patterns vertically should yield similar effects. Therefore, this paper focuses target patterns that exhibit an upward trend after the starting point. Under these three target patterns, this paper demonstrates that BackTTmee effectively attack various target patterns in MTS forecasting.
validate the effectiveness of BACKTIME three different shapes of the target
shown in Figure 4 The endpoints of the three target patterns
E
Main Experiment Results
The full results for BACKTIME and baselines with the cone-shaped target pattern are provided in Table From the results, we can observe that BACKTIME can continuously decrease MAE, to low degree under any model architecture and any dataset. On PEMS03, PEMS04, and Weather datasets, BACKTIME surpass all the attack baselines, achieving the lowest MAE, across all the model architectures. It strongly demonstrates the effectiveness and versatility of BACKTIME.
18

---

Table 8: Main results of backdoor attack on MTS forecasting. For all the metrics, the lower the better. Bold font indicates the best performance for the attack effectiveness.
Clean
Random MAE.
Inverse
Manhattan MAE:
BACKTIME
Dataset
Models
MAE;
MAEA
MAEA
MAE,
MAEA
MAEA
MAE.
MAE,
TimesNet
20.00
28.63
20.92
29.30
20.03
26.62
19.89
26.33
21.23
20.83
FEDformer
15.78
39.86
16.14
15.70
16.18
16.05
16.42
17.10
16.34
14.05
PEMS03
Autoformer
16.03
38.38
17.09
20.98
17.23
20.55
16.75
22.13
17.12
17.68
Average
17.27
35.62
18.05
21.99
17.81
21.07
17.69
21.85
18.23
17.52
TimesNet
22.95
$1.43
23.94
46.27
24.47
33.56
23.91
38.55
24.43
25.66
FEDforeer
28.83
44.75
17.95
16.67
21.23
20.52
21.37
25.89
21.51
25.92
PEMS04
Autoformer
21.24
44.28
22.62
22.12
24.43
22.80
28.41
21.86
26. 94
Averuge
24.34
46.82
21.50
30.01
22.61
26.17
22.69
30.95
22.60
26.17
TimesNet
21.66
55.66
22.21
39.18
22.68
37.20
22.61
31.00
23.17
27.60
FCDfomer
17.87
27.83
18.08
31.35
18.29
28.03
19.07
18.47
17.70
16.59
PEMS08
Autoformer
18.38
38.48
19.13
33.54
19.30
25.95
19.44
23.94
18.13
20.24
Average
19.30
40.66
19.81
34.69
20.09
30.39
20.37
24.47
19.67
21.48
TimesNet
17.95
91.86
21.73
18.39
18.74
46.71
24.87
44.84
8.38
14.97
Weather
FEDformer
9.83
97.07
11.13
16.88
9.85
77.74
10.35
95.50
8.64
15.87
Autoformer
10.47
94.36
10.73
36.01
12.42
72.23
11.41
81.31
8.28
15.63
Average
12.75
94.43
14.53
23.76
13.67
65.56
15.54
73.88
8.43
15.49
TimesNet
1.25
2.50
1.31
1.67
1.33
1.49
1.31
1.63
1.20
1.45
FEDformer
1.19
2.55
1.21
1.56
1.27
1.70
1.20
1.87
1.10
1.35
ETTml
Autoformer
1.32
2.68
1.32
1.54
1.36
1.41
1.34
1.97
1.12
1.42
Averuge
2.58
1.59
1.32
1.53
1.28
1.82
1.14
NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We clarify that scope of our method both Abstract Introduction, and also provide detailed contributions in Introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: [Yes]
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well vell-specification asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
19

---

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Answer: [Yes]
Justification: We provide the detailed setting as well as the hyperparameters in the Experi- ment section
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same datasct, provide access to the model. In general. releasing code and data is often
20

---

one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g.. a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
After our paper is accepted, we will provide open access to our data and codes.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. ec/
cablic/guides Staia//guuidss/oooeuunniisssss CodeSubmisssonnoll
wassonooiicyy oolicy) for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https Cwwoeeeumiissionn...oo
/
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide all the information about the algorithms, the model architecture and hyperparameters.
Guidelines:
21

---

The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [NA]
Justification: Due to the page limitation, we don't provide error bars in this paper, but we provide the mean results for all the experiment settings.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative eтror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [No]
Justification: Our algorithm do not require a high computer resources, and thus we do not think is need for specify it.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics htttinggipppp//.orrr...../ppp/pp
Answer: [Yes]
22

---

Justification:
Our research strictly follows NeurIPS COde of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there is a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: Our work has no series societal impact.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploymentt of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI...
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification: [Yes]
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
23

---

12. Licenses for existing assets
Question:
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We provide the links for all the assets use.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information is available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
24

---

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
25


Reviews:
[{"review_id": "w8SY2h0GcH", "reviewer": "Reviewer_mt9q", "summary": "This paper primarily discusses how to conduct a backdoor attack on the multivariate time series forecasting task, proposing a two-stage training approach. The core idea is to identify timestamps with significant differences in MAE of the Clean model and Poisoned model on poisoned data points. Simultaneously, the trigger generation function is learned by minimizing the MAE loss of the model's prediction of the target pattern with triggers as input.", "questions": "1. In Equation 3, according to the paragraph from lines 189-190, the clean loss should be the MAE using the clean samples to predict the ground truth, and the attack loss should be the MAE using the poisoned samples to predict the target pattern, right? However, in Equation 3, both MAE losses target $X^{ATK}_{ti,f}$. Here, clarification from the author is requested.\n2. The training of the trigger generation network depends on initially manually generating some attack samples. Does the quality of these initial samples significantly affect the following training process? \n3. The two-stage training is very unstable, which the author mentioned in the paper, but there is no detailed description in the text. It would be helpful to understand the rationality of the model design if the author could provide the training loss change curve.", "limitations": "The author has discussed in the paper how to prevent the injected data points from having too large a magnitude and how to address training instability issues.", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "1. This is a quite interesting and important research topic. However, the example provided by the author regarding traffic prediction is not convincing enough. Traffic prediction data is collected and trained by private systems. If one can already access the system to inject toxic data, there would be simpler and more effective methods than backdoor attacks. If the author can provide some scenarios where the time series data points are provided by third-party systems, it would better illustrate the necessity of this paper.\n2. The author's writing is clear and easy to follow.\n3. The author has proposed a framework that can be applied to various time series prediction backbones and has conducted a comprehensive evaluation of effectiveness.", "weaknesses": "1. The baseline methods in the paper are heuristic, and the worse MAE of these methods compared to the proposed method in the paper does not effectively illustrate the issue.\n2. The types of anomalies illustrated in the paper are relatively simple.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> **Q1. The baseline methods in the paper are heuristic, and the worse MAE of these methods compared to the proposed method in the paper does not effectively illustrate the issue.**\n\nThank you for your concern on the baselines in our papers. We agree with the reviewer that the baselines in this paper are heuristic and MAE may not fully evaluate our method. However, due to the character limit, we kindly ask the reviewer to refer to our response to the reviewer Pmgc's Q2 for a more comprehensive discussion.\n\n> **Q2. The types of anomalies illustrated in the paper are relatively simple.**\n\nThank you very much for your valuable suggestions. As the reviewer correctly pointed out, the main goal of this work is to demonstrate the feasibility of backdoor attacks on multivariate time series, and therefore, we did not focus on complex target patterns. However, we would like to emphasize that BackTime can effectively perform attacks, even with complex target patterns.\n\nTo illustrate this, we have conducted additional experiments on the PEMS03 dataset, attacking the TimesNet model using three different complex target patterns. Since it is challenging to design complex target patterns when the pattern length is too short, we set the pattern length to 17 in the new experiments instead of 7 as mentioned in the paper. The target patterns are provided at Figure 1 with the format of PDF on the global rebuttal.\n\nThe experimental results are presented in the following table. As shown in the table, $MAE_A$ and $RMSE_A$ reach a quite low value, even lower than $MAE_C$ and $RMSE_C$. It demonstrates that BackTime successfully completes the attack even with complex patterns, demonstrating its superiority. Once again, thank you for your insightful comments and suggestions. They have been incredibly helpful in further improving our work.\n\n|           | $MAE_C$ | $RMSE_C$ | $MAE_A$ | $RMSE_A$ |\n|-----------|--------|---------|--------|---------|\n| Pattern 1 | 22.42  | 36.88   | 20.41  | 29.80   |\n| Pattern 2 | 22.85  | 37.35   | 20.35  | 29.78   |\n| Pattern 3 | 22.47  | 36.97   | 20.37  | 29.70   |\n\n> **Q3. In Eq. (3), the clean loss should be the MAE using the clean samples to predict the ground truth, and the attack loss should be the MAE using the poisoned samples to predict the target pattern, right? However, in Eq. (3), both MAE losses target $X_{ti,f}^{ATK}$.**\n\nThanks for your valuable comments on our notations. As you pointed out, the attack loss is used to update the trigger for the purpose of predicting the target pattern. To achieve this, we introduce $\\beta(t_i)$ in the upper-level optimization to locate the target pattern within $X^{ATK}$. \n\nHowever, there seems to be a misunderstanding regarding the precise role of the clean loss. $X^{ATk}$, the attacked dataset, contains both clean time slices and attacked time slices. Victims may train their model on this attacked dataset $X^{ATK}$, resulting in an attacked model that carries the backdoor. Therefore, the lower-level optimization still uses $X^{ATK}$, and the clean loss here refers to the common loss function in the forecasting task, such as MAE. We believe the term \"clean loss\" might have caused this misunderstanding. Therefore, we will change this term to \"natural loss\" in the revised version to clarify its meaning.\n\n> **Q4. The training of the trigger generation network depends on initially manually generating some attack samples. Does the quality of these initial samples significantly affect the following training process?**\n\nThank you for your attention to the trigger generation network. As mentioned in line 264 of our paper, we introduced the \"adaptive trigger generation\" mechanism. Thus, after end-to-end training of the trigger generator, triggers could be adaptively acquired, and there is no need for manually setting the initial attack samples. \n\nSpecifically, the trigger generator injects the generated trigger into the poisoned dataset $\\mathbf{X}^{ATK}$, and the surrogate model $f_s$ is leveraged to evaluate and update the trigger. Intuitively, an effective trigger should induce $f_s$ to predict the future as the target pattern. Thus, after freezing the parameters of $f_s$, we update the parameter of the trigger generator to reduce the difference between the predictions of $f_s$ and the target pattern. Once the trigger generator is well-trained, it can adaptively output effective triggers.\n\nPerhaps the current description on trigger generation has caused this misunderstanding. We will provide a more detailed explanation in the revised version.\n\n> **Q5. Could the author provide some scenarios where the time series data points are provided by third-party systems?**\n\nThank you for your concern about the scenarios. BackTime can be leveraged in several application scenarios where the data are collected by third-party systems, beyond just traffic prediction. However, due to the character limit, we kindly ask the reviewer to refer to the second paragraph of our response to reviewer Bpy4's Q2 for a detailed discussion.\n\n> **Q6. The two-stage training is unstable, but there is no detailed description in the text. It would be helpful to understand the rationality of the model design if the author could provide the loss curve.**\n\nThank you for your valuable comments. The two-stage training is a crucial part of BackTime's training process. Sorry for not providing detailed explanations in the original version due to the page limit. We are more than willing to include a thorough description of this process in the updated version of our paper.\n\nWe have also provided a detailed explanation in response to the Reviewer Pmgc's Q1, and we hope these clarifications will resolve some confusions. Additionally, as the reviewer's request, we have provided the loss function curves in Figure 2 on the global rebuttal to help understand the two-stage training process.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aYHTCmhPZm", "reviewer": "Reviewer_PmgC", "summary": "This paper proposed a backdoor attach method for multivariate time series forecasting, where only a few works focus on this topic. The injected stealthy triggers are interesting and effective in destroying raw data.", "questions": "1. The Trigger Generation and Bi-level Optimization are not clearly presented. Please extend the description of trigger generation and effectiveness.\n2. The experiments need to be expanded, and the advantages of the proposed method are not well validated. \n3. Numerically, the authors could consider comparing their method with more baselines. There are some studies on backdoor attacks for forecasting models.", "limitations": "1. What is the technical drawback of the proposed method? E.g., attack efficiency and hidden effect.\n2. Are there any initial ideas to be able to look forward from a defense perspective?", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "The originality of this paper is solid, since this is the first work to consider the backdoor attack in MTS forecasting. The quality and clarity of this paper are also good for understanding. The significance of this paper is relatively well-clarified.", "weaknesses": "1. The Trigger Generation and Bi-level Optimization are not clearly presented. Please extend the description of trigger generation and effectiveness.\n2. The experiments need to be expanded, and the advantages of the proposed method are not well validated. \n3. Numerically, the authors could consider comparing their method with more baselines. There are some studies on backdoor attacks for forecasting models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> **Q1. The Trigger Generation and Bi-level Optimization are not clearly presented. Please extend the description of trigger generation and effectiveness.**\n\nThank you for your attention to the trigger generation and bi-level optimization. These two components are indeed core parts of BackTime. However, due to the page limit, we were unable to provide a detailed description in the original version. We are more than willing to elaborate on these two components in the revised version.\n\nRegarding trigger generation, for the sake of stealthiness, we aim to generate triggers that are similar to the data preceding the injected triggers. Therefore, we extract the time series data before the injected triggers, denoted as $\\mathbf{X}^{ATK}[t_i - t^{BEF} - t^{TGR}:t_i - t^{TGR}]$ in Eq. (5), and use it as the input to the trigger generator (a GCN). The GCN effectively generates the trigger by integrating the time series data before triggers and the correlation graph. However, as mentioned in the paper, the amplitude of the GCN's output could be large, which poses a significant challenge to the convergence of the training process. To address this, we apply the tanh function to scale the output, and utilize the scaled outputs as the final triggers as shown in Eq. (6).\n\nDuring the training process, the trigger generator is updated adaptively in an end-to-end manner. Specifically, the trigger generator injects the generated trigger into the poisoned dataset $\\mathbf{X}^{ATK}$, and the surrogate model $f_s$ is leveraged to evaluate and update the trigger. Intuitively, an effective trigger should induce $f_s$ to predict the future as the target pattern. Thus, after freezing the parameters of $f_s$, we use  $l_{tgr}$ in Eq. (10) as the loss function to update the trigger generator, aiming to reduce the difference between the predictions of $f_s$ and the target pattern.\n\n> **Q2. The advantages of the proposed method are not well validated, and the authors could consider comparing BackTime with more baselines. There are some studies on backdoor attacks for forecasting models.**\n\nWe agree with the reviewer in that the baselines in this paper are heuristic and MAE may not fully evaluate our method. Meanwhile, we would like to emphasize the superiority of BackTime from two perspectives.\n\nFirst, on four datasets (PEMS03, PEMS08, Weather, and ETT), our method reduces $MAE_A$ by 50.8\\%, 52.64\\%, 83.52\\%, and 45.40\\% compared to clean training, respectively. Even when compared with the best baseline in this paper, BackTime also reduces $MAE_A$ by 16.84\\%, 12.26\\%, 34.80\\%, and 7.84\\%. These results demonstrate that BackTime effectively implements a backdoor attack on multivariate time series (MTS).\n\nSecond, we would like to highlight that our work is the **first** to focus on backdoor attacks in MTS forecasting and formally define a backdoor attack framework for time series forecasting. As such, finding suitable backdoor attack methods for MTS forecasting as baselines is challenging. To our best knowledge, there are not existing baselines in the literature that directly apply to our setting. Therefore, we designed a few heuristic methods as the baselines.\n\nTo better address reviewer's concerns,  we have provided additional classic adversarial attack methods, such as FGSM and PGD, as baselines. Specifically, we generated adversarial perturbations to induce the model to predict the target pattern. The experimental results are as follows. From the table, PGD and FGSM not only failed to implement effective backdoor attacks but also significantly reduced the model's forecasting performance. One of the reasons is that the generated adversarial perturbations exhibit significant difference from the real data, hence impeding models' learning on clean features. This highlights the necessity for meticulously designed triggers in backdoor attacks on time series forecasting and randomly chosen perturbations highly likely fail to implement effective attacks.\n\nIf there is any specific baseline the reviewer would like to let us include, we would be more than happy to include them in our evaluation.\n\n|          | $MAE_C$ | $RMSE_C$ | $MAE_A$ | $RMSE_A$ |\n|----------|---------|----------|---------|----------|\n| Clean    | 20.00   | 34.18    | 28.63   | 46.69    |\n| FGSM     | 110.04  | 151.71   | 91.13   | 149.76   |\n| PGD      | 108.86  | 150.43   | 90.01   | 147.07   |\n| BackTime | 21.23   | 35.22    | 20.83   | 30.94    |\n\n> **Q3. What is the technical drawback of the proposed method? E.g., attack efficiency and hidden effect.**\n\nThank you for your attention to the technical drawbacks and limitations of BackTime. We acknowledge that BackTime may not exhibit good attack efficiency in certain application scenarios. However, due to the character limit, we kindly ask the reviewers to refer to our response to the reviewer Bpy4's Q1 for a more comprehensive discussion.\n\n> **Q4. Are there any initial ideas to be able to look forward from a defense perspective?**\n\nThank you for your attention to potential defenses against backdoor attacks in time series data. Backdoor defense is indeed an important and promising future direction. While it will require a separate study to develop a full solution, we do have some initial ideas for backdoor defenses. First, there may be a frequency difference between the generated triggers and the target pattern compared to the real data. Hence, detecting the distribution drift in the frequency domain could be a promising approach. Additionally, the generated triggers might not exhibit the same rich diversity as real data. Consequently, in the feature space, the (trigger, target pattern) pair might cluster closely with each other, making detection via clustering algorithms feasible.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "sLXPQ20uhv", "reviewer": "Reviewer_Bpy4", "summary": "The paper titled \"BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting\" introduces a novel method called BACKTIME, aimed at exploring the robustness of multivariate time series (MTS) forecasting models against backdoor attacks. BACKTIME enables an attacker to subtly manipulate predictions by injecting stealthy triggers into the MTS data. Through a bi-level optimization process using a graph neural network (GNN)-based trigger generator, the method identifies vulnerable timestamps and crafts effective, covert triggers. Comprehensive experiments across various datasets and cutting-edge MTS forecasting models demonstrate the efficacy, flexibility, and stealth of BACKTIME attacks.", "questions": "- What are the potential limitations of the proposed method, especially regarding its generalizability to other types of time series data or forecasting models?", "limitations": "- The authors have not adequately addressed the limitations of their work, nor have they discussed the potential negative societal impacts of BACKTIME.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The BACKTIME method offers a fresh perspective on backdoor attacks in MTS forecasting, demonstrating the feasibility and impact of such attacks.\n- The experimental setup is comprehensive and includes multiple datasets and state-of-the-art forecasting models, showcasing the method's versatility.\n- The paper provides clear explanations of the bi-level optimization process and the role of the GNN-based trigger generator, facilitating understanding of the attack mechanism.\n- The research highlights the need for robustness in MTS forecasting models, particularly in high-stake scenarios where malicious attacks could have serious consequences.", "weaknesses": "- The paper does not adequately address potential limitations or discuss the robustness of the method against countermeasures. A more detailed analysis of the limitations and how they might affect the practical applicability of BACKTIME would strengthen the paper.\n- The potential negative societal impacts of such attacks are not sufficiently explored. Given the sensitive nature of MTS forecasting in areas like climate, epidemiology, and finance, a deeper discussion on the broader implications is warranted.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> **Q1. The paper does not adequately address potential limitations or discuss the robustness of the method against countermeasures. A more detailed analysis of the limitations and how they might affect the practical applicability of BACKTIME would strengthen the paper.**\n\nThanks for the reviewer's valuable comments. We acknowledge that BackTime indeed has certain limitations.\n\nFirstly, it is challenging to leverage BackTime on time series imputation tasks. To achieve an effective backdoor attack, BackTime concatenates the trigger and the target pattern sequentially to establish a strong temporal association. This association is the foundation of BackTime's attack efficiency. However, in time series imputation, deep learning models can infer based on data both before and after the missing values. Thus, the models may not rely heavily on the data preceding the missing values, which breaks the basic assumptions of BackTime. Hence, BackTime may not be able to implement an effective attack in this scenario.\n\nSecondly, BackTime may struggle with datasets that contain missing data. BackTime predicts the target pattern only when the trigger is included within the inputs. Therefore, BackTime poses a requirement for the completeness of triggers. If the trigger itself is incomplete, the attacked deep learning model may fail to recognize the existence of the triggers, leading to an ineffective backdoor attack.\n\nThirdly, the success of backdoor attacks relies on the redundancy of the learning capacity of deep learning models. In other words, deep learning models can complete specific tasks using only a subset of neurons, while the remaining neurons respond weakly or not at all. Thus, backdoor attacks aim to manipulate these weakly responding neurons to execute the attack without compromising the model's effectiveness. Consequently, backdoor attacks are typically more effective on deeper models with larger parameter sizes, such as TimesNet, Autoformer, and FEDformer in our paper. If the victim chooses a simple model for time series forecasting, such as MLP, the effectiveness of BackTime might deteriorate.\n\nAnother limitation of this work is that it does not offer a solution for defense. To address this gap, we have outlined some preliminary ideas on how to defend against BackTime. First, there may be a frequency difference between the generated triggers and the target pattern compared to the real data. Hence, detecting the distribution drift in the frequency domain could be a promising approach. Additionally, the generated triggers might not exhibit the same rich diversity as real data. Consequently, in the feature space, the (trigger, target pattern) pair might cluster closely with each other, making detection via clustering algorithms feasible.\n\n> **Q2. The potential negative societal impacts of such attacks are not sufficiently explored. Given the sensitive nature of MTS forecasting in areas like climate, epidemiology, and finance, a deeper discussion on the broader implications is warranted.**\n\nThank you for your concern regarding the potential societal impacts of BackTime. As a backdoor attack method, the misuse of BackTime indeed poses the risk of negative social consequences.\n\nSpecifically, in the financial markets, attackers could exploit BackTime to inject stealthy backdoors into stock price prediction models, enabling market manipulation and illicit profit gains. This could lead to increased market volatility and eroded investor confidence. In public transportation, as mentioned in lines 27 - 32 of our paper, BackTime could cause transportation prediction models to output incorrect results. This could negatively impact traffic signal control and route planning, resulting in increased traffic congestion and accidents. In the healthcare field, medical monitoring systems often rely on time series data, such as ECG datasets. A backdoor attack could cause data-driven healthcare models to produce erroneous diagnostic results, potentially affecting treatment plans and endangering patient health.\n\nGiven the potential risks of BackTime, we present several ways to mitigate its negative societal impacts. From the perspective of data collection, researchers should be aware of the risk of backdoor injection into publicly available time series datasets. Therefore, when using public datasets for training, it is recommended to rigorously inspect and cleanse the data to minimize the impact from malicious data injection. We have provided some possible data detection methods in Q1. Due to the character limit, we do not provide a detailed description here. From the perspective of model training, researchers can enhance model robustness. For example, by employing adversarial training strategies, researchers can reduce the model's sensitivity to specific perturbations, thus enabling the model to resist backdoor trigger samples. From the perspective of model deployment, researchers can establish real-time monitoring systems to detect anomalies in system inputs and outputs. Effective anomaly detection algorithms can help promptly identify potential attacks.\n\nOnce again, thank you for your insightful comments and suggestions. We will incorporate our response to both Q1 and Q2 in the revised version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
1. Figure 1 visualizes three different target patterns. 
    - Experiments on the response to the reviewer mt9q’s Q2 show that BackTime successfully completes the attack even with complex target patterns. 
2. Figure 2 visualizes the loss curve of the two-stage training process in BackTime.
    - We use the same color to plot the two loss ($l_{cln}$ and $l_{tgr}$) within the same epoch.
    - During each epoch of the two-stage training, we run the clean training first, as shown in the upper figure, and then update the trigger generator, as shown in the lower figure

Meta-review: This paper proposes a backdoor attack method on multivariate time series forecasting task. It uses MAE to identify attack susceptible time frame, and then use GCN to generate an adaptive trigger. The method is trained with a bi-level optimization. Reviewers agree that the problem and the solution are novel, and the validation is sufficient.
Decision: Accept (spotlight)