Fortifying Time Series: DTW-Certified Robust Anomaly Detection
Authors: Shijie Liu
Tansu Alpcan
Christopher Leckie
Sarah Monazam Erfani
Venue: NeurIPS 2025 poster ()
Keywords: Certified Robustness
Anomaly Detection
Time Series
Primary area: general_machine_learning
TL;DR: We propose the first certified defense tailored for time-series data under Dynamic Time Warping (DTW) distance.

Abstract: Time-series anomaly detection is critical for ensuring safety in high-stakes applications, where robustness is a fundamental requirement rather than a mere performance metric. Addressing the vulnerability of these systems to adversarial manipulation is therefore essential. Existing defenses are largely heuristic or provide certified robustness only under $\ell_p$-norm constraints, which are incompatible with time-series data. In particular, $\ell_p$-norm fails to capture the intrinsic temporal structure in time series, causing small temporal distortions to significantly alter the $\ell_p$-norm measures. Instead, the similarity metric Dynamic Time Warping (DTW) is more suitable and widely adopted in the time-series domain, as DTW accounts for temporal alignment and remains robust to temporal variations. To date, however, there has been no certifiable robustness result in this metric that provides guarantees. In this work, we introduce the first DTW-certified robust defense in time-series anomaly detection by adapting the randomized smoothing paradigm. We develop this certificate by bridging the $\ell_p$-norm to DTW distance through a lower-bound transformation. Extensive experiments across various datasets and models validate the effectiveness and practicality of our theoretical approach. Results demonstrate significantly improved performance, e.g., up to 18.7\% in F1-score under DTW-based adversarial attacks compared to traditional certified models.

Fortifying Time Series: DTW-Certified Robust Anomaly Detection
Shijie Liu Tansu Alpcan', Christopher Leckie", Sarah Erfani
'Department of Electrical and Electronic Engineering University Melbourne, Melbourne, Australia 2School of Computing and Information Systems University of Melbourne, Melbourne, Australia "shijie3@unimelb. edu.au
Abstract
Time-series anomaly detection is critical for ensuring safety in high-stakes ap- plications, where robustness is fundamental requirement rather than mere performance metric. Addressing the vulnerability these systems to adversarial manipulation is therefore essential. Existing defenses are largely heuristic or pro- vide certified robustness only under é, 2--norm constraints, which are incompatible with time-series data. In particular, fp-norm fails to capture the intrinsic temporal structure in time series, causing small temporal distortions to significantly alter the E-norm measures. Instead, the similarity metrie Dynamic Time Warping (DTW) is more suitable and widely adopted in the time-series domain, as DTW accounts for temporal alignment and remains robust temporal variations. To date, however, there has been no certifiable robustness result in this metric that provides guarantees. In this work, we introduce the first DTW-certified robust defense in time-series anomaly detection by adapting the randomized smoothing paradigm. We develop this certificate by bridging the f,-norm to DTW distance through lower-bound transformation. Extensive experiments across various datasets and models validate the effectiveness and practicality of our theoretical approach. Results demon- strate significantly improved performance, e.g., up to 18.7% in F1-score under DTW-based adversarial attacks compared traditional certified models.
Introduction
In recent years, significant research has advanced the study of adversarial attacks and certified defenses for machine learning systems. Despite the considerable progress in adversarial robustness across various domains 42
2 [45]
9 12
3) robustness in time-series anomaly detection remains
comparatively underexplored. As a core component of many safety-critical systems-includie
healthcare 25 46 21), finance 41 22 64 and mobile networks [56] 70 35
anomaly detectors
are essential for identifying abnormal behavior in preventing failures or hazards. Robustness this context merely model performance concern but core requirement for operational reliability. Recent work has revealed that time-series anomaly detectors are susceptible to adversarial attacks tailored the characteristics of time-series data [6] (,, underscoring the urgent need for ensuring robustness in this domain.
Adversaries can manipulate detection outcomes by introducing subtle yet strategically crafted per- turbations into anomaly time-series data evade detection [61| 29 [4] 69]. Traditional adversarial threat models typically restrict perturbations to bounded -ormmss widely effective in image 11 31 and text domains 63 76 57 due to the alignment with semantic preservation in such data types. However, time-series data exhibit inherent temporal structure that challenges the assumption of
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

More Sophisticated Time-Series Anomaly
More Robust
Adversarial Anomaly with shift
Anomaly Detector
Anomaly
Adversarial Perturbation
Adversarial Anomaly
Shift, Scale, Delay,
to
to
to
Result
Alignment Distunce
Result Alignment & Distance
Result
Anomaly Detector
Anomaly
Benign
Benign
Lo-norm-Robust Anomaly Detector
Anomaly
Anomaly
Benígn
(Radii -0.3)
by norr:: 0.2 < R4p
norom: 1.42 Ri,
DTWW-Robust
Anomaly Detector
Anomaly
Anomaly
Anomaly
(Radit R.33
Temporal Alignment
DTW: 0.2 RETW
DTW: 0.2 ROTW
Figure 1: Comparison of standard, L no-norm-robust, and DTW-robust anomaly detectors under adversarial perturbations. DTW facilitates optimal temporal alignment, offering a more meaningful similarity measure for time-series data, thereby ensuring more comprehensive robustness guarantees against adversarial examples.
-n-norms. As illustrated in Figure small temporal transformations such as shifts or rescaling can significantly inflate f--norm distance (e.g., from 0.2 to 1.4), despite there being no change to the underlying semantics (c.g., green and blue represent the identical time scries). This mismatch renders lp -p-nomms inadequate for measuring meaningful similarity in time-series data, limiting their utility for robustness measurement.
Addressing this limitation, we advocate for the use of Dynamic Time Warping (DTW) distance, commonly used similarity metric specifically designed for time-series data. As shown the bottom right of Figure] [ DTW accommodates temporal alignments, which effectively handles temporal variations such as shifts, stretching, and compression. This alignment flexibility preserves structural similarities better than ep-norms, consistently demonstrating superior performance for diverse time- series tasks 24 19]. As a result, a DTW-robust detector exhibits stable distance measurements under temporal variations (c.g., consistently 0.2 in Figure [ offering more reliable robustness guarantees compared to én-norm. The need for developing defenses under the DTW distance is further emphasized by recent demonstrations of DTW-based adversarial attacks 6 5), for which certified defenses currently exist.
In response to adversarial attacks, various defensive strategies have been proposed 38 Although these empirical defenses provide some resilience, adaptive attackers can often bypass them 10
20
65 75). Certified defenses [32 [8 55), in contrast, guarantee theoretical robustness against worst-case adversarial scenarios, making them particularly appealing for safety-critical applications. While significant progress has been made in certified robustness under fp-norm
constraints 33 55 18 54, 33 722. its adaptation to seressrris data-under the proper DTW
constraints- remains unexplored.
In this paper, we propose the first DTW-certifidd robustness framework in time-series anomaly de- tection by adapting the randomized smoothing approach [18] Our approach establishes novel certification method by bridging -orm guarantees the DTW distance through lower-bound transformation. By leveraging the Keogh Lower Bound (28) we are able to derive a closed-fone expression of the DTW-certified radius a smoothed model. The resulting framework model- agnostic and readily applicable to any pre-trained anomaly detector. Extensive evaluations on real-world datasets and variety of detection architectures highlight the broad applicability and effec- tiveness of our method, demonstrating clear ad advantages over traditional & normo-m-arn merticertifiedd defenses,

---

e.g., under DTW-based adversarial attacks, our method achieves up to an 18.7% improvement in Fl-score.
Our key contributions include:
We introduce the first theoretical framework that provides certified robustness in DTW distance, addressing an essential yet unexplored gap in time-series anomaly detection.
We present generalizable defense mechanism that seamlessly integrates DTW certification with any anomaly detection models, significantly enhancing robustness in practice.
We provide comprehensive experimental evaluations demonstrating the practical efficacy of our DTW-certified robustness approach across diverse scenarios.
Related Work
Time-series Anomaly Detection Time-series data, consisting of data points sequentially indexed over time, is prevalent across various domains. Detecting anomalies within time-series data is of significant importance 40
46 [1], anomalies often indicate novel, unexpected, or potentially critical events. Recent advances in deep learning have significantly improved detection by enabling models capture complex temporal and inter-metric dependencies. Modern deep anomaly detectors [62] 13 (36] have shown strong performance across a range of time-series tasks. However, they also share the same vulnerabilities to adversarial attacks as other machine learning models.
49 16
25
Adversarial Attacks Adversarial attacks refer to deliberate perturbations introduced into input data to intentionally mislead machine learning models into making incorrect predictions. Typically, these perturbations are minimal in terms of the fy-norm, ensuring the semantic consistency and being imperceptible humans. Such vulnerabilities have been widely demonstrated across various deep learning models 3 63
57], including anomaly detection tasks [6 74 69
However, the n--norm is inadequate for measuring differences in fime-series data, it fails to account for the underlying temporal structure. Recent studies (6 5 have addressed these issues by adopting the DTW distance, widely recognized measure suitable for time-series analysis, to construct adversarial examples. These studies highlight that DTW-based adversarial attacks are more effective, the set of permissible perturbations under DTW forms superset of those constrained by an equivalent lp noro.. Additionally, they demonstrate that the defensive strategies designed to counter l, nooom adversarial attacks exhibit limited effectiveness against DTW-based attacks [39]. highlighting the need for dedicated defenses under the DTW threat model.
Certified Robustness Prior defenses such as adversarial training [39]. defensive distillation 44 and data purification [66] offer empirical robustness, but are often circumvented by adaptive adver- saries 10 65 7.5) In contrast, certified defenses have gained significant attention for providing formal, provable guarantees against all possible attacks within a perturbation bound [32 53 In
the context of time-series anomaly detection, certified defenses against f--norm attacks have been initially considered in [23] 8) through direct application of randomized smoothing (18. However, as discussed, the resulting fo-norm certificate is inadequate for time-series data and remains vulnerable to DTW-based attacks. Existing defences (6] against DTW-based attacks have been limited to empir- ical without any certification. This work introduces the first certified defense against DTW-base
adversarial attacks.
DTW-Certified Defense in Time-Series Anomaly Detection
3.1 Problem Setup
Time-Series Anomaly Detector We define the space of time-series signals as X' R I.x. where represents the signal length and C' denotes the number of channels. Following the common framework for time-serics anomaly detection [7T] 67 3T) we consider a detector d' RTxC
y = {0, 1} that operates sliding window of size T < L. Given an input sequenee E TTC the detector computes an anomaly score fx) E TR, which quantifies the likelihood of x being an anomaly, and makes the detection decision via comparing f(x) against the anomaly threshold 7::
1, f(x) >?
d(x)
(1)
0, f(x) ST.
3

---

where y = 1 indicates an anomalous instance, and y = 0 denotes benign instance.
Distance Metries The difference between time-series and x' be naively measured by the fn-norm distance as
T Σ
1/p
||: - 2211>
(2)
where v; represent the i-th element in x. However, such a measurement fails to capture the temporal structure of time-series data. Therefore, we consider the Dynamic Time Warping (DTW) distance, which resolves the issues by finding the optimal temporal alignment that minimizes the total distance between aligned time-series. Formally, the DTW distance of norm order p is defined as:
1/p
DTW,( = min TEA(n,)))
Σ b x
(i:))T
where represents an alignment path of length T as sequence of T index pairs ((1.:1)..... (r)) and A(z, is the set of all admissible paths. An admissible path should satisfy the following conditions: 1) Matched ends, as क (1, 1) and कт (T, T). and 2) Monoton- ically increasing and each time series index should appear at least once, as ig-1 S is S ig-1 + and ji-1 S jk S jk-1 + 1. We adopt 2 as the default norm for DTW in the main text for clarity of exposition; however, the proposed approach generalizes readily to arbitrary norm orders p with minimal modification detailed in Appendix C
Threat Model We assume strong adversary with white-box access to the anomaly detector d, meaning the attacker has full knowledge of the detector and unlimited computational power. Given an input classified by the detector as y f(x). the attacker seeks an alternative input x' to perform either an evasion attack- suppressing the detection of an actual anomaly, or availability beruckkinduccing false alarm on benign input, such that d(x')= * d(x).. preserve the semantics of the original anomaly the perturbation in x must be constrained within DTW distance e as DTW x') <.
Certified Defense Goal The anomaly detector d is said to provide certified defense at input x of DTW radius e, if there exist x' {s' DTW DTW(x,,')) < e} such that d(x') # d(x;) with probability at least 1 a.
3.2 Theoretical Analysis of DTW-Certified Robustness
In this section, we first review the core components of our approach: the randomized smoothing framework [8 15 and the DTW lower bound [28]. We then present Lemma (3.2 which establishes a formal link between f--norm distances and the DTW lower bound. Building on this connection, we introduce the main theoretical result Theorem 3.3 which derives DTW robustness certificate from smoothed model via the Keogh Lower Bound.
f,-norm Certificate via Randomized Smoothing Randomized smoothing 17 smoothed function by taking the Gaussian expectation of a base function f (we defer the details in Appendix Ap. However, in time-series anomaly detection, the base function f(x))which outputs an anomaly y score for time series r-is typically unbounded and may exhibit high variance. As result, estimating the Gaussian mean can lead to loose and unreliable robustness bounds.
constructs
To address this, we adopt the percentile smoothing approach [[4, which bounds the p-th percentiles of the base function outputs instead of the mean. Such smoothing method is more robust to outliers and variance the output distribution. We construct the smoothed anomaly score function (x) X + R of the anomaly score function f. as
(x) sup u E R IP + n) S u] p).
The hp does not admit closed form, its value can be bounded by Monte Carlo sampling as outlined in Section 3.3 With the percentile smoothed function, the anomaly score (x'x') of the adversarial input x' can be certifiably bounded by h(x)), as
Lemma 3.1. A percentile smoothed function hp can be bounded as
hx(xx) < hp(x') & ha(rr) Va' E {a' || x < r).
(5)
where p (p)-1(p) 5) and p ( + F), with & being the standard Gaussian CDF.

---

Lower Bound of DTW The exact computation of DTW is typically expensive and slow, i.c., quadratic time and space complexity. To address this, various lower bounds have been proposed to approximate DTW efficiently. One of the widely used bounds is the Keogh Lower Bound [28 47 LB_ K Tegh(a2 x'), which is calculated by defining two new time series, upper U and lower envelopes. For each time step i and channel k, the envelopes are defined as:
U.A max Fitw.))
(6)
Li min(xi-m.. Ii+m,k)
where the w : 1 S w S is the DTW wrapping window size (Sakoe-Chiba band) [52] that constrains only ny and n'y within the window can be aligned. The IB _ eoggh(2 x²) ) is calculated as
( - Up ( 1
of U2,ks if if Li,ks otherwise.
LB Keogh,(z,
In summary, the lower bound is calculated as the sum of -y-norm distances to the envelope of points in x' that are outside the envelope of
DTW-Certificate In the following, we present the theoretical foundation for deriving DTW- certified robustness, offering robustness measure that is better aligned with the temporal nature of time-series data. By leveraging the percentile-smoother function and the DTW lower bound, we introduce lemma that establishes connection between the f,-norm certificate and a robustness certificate in DTW distance through a lower-bound transformation.
Lemma 3.2. Suppose the certification of smoothed function h. holds for data x. as h(x') S
b, Va' E {a' || - æ=I| S r- Then, the certification a S. h((x)) I b, Va' E {x' DTW((,,)) Se) e) also holds, where LB(x, x²) is strict lower bound of DTW (I, x') and
e ==inf[LB(z, x') |
x'1 > r).
(8)
Proof. Assume for the sake of contradiction that the chosen x' does not lie in the 12-ball. Then we
have ||a' =|I| > r. Since x' is outside the ball, by the definition of know that LB( e.
This contradicts LB(r, x²) < DTW (z, x²) S by the definition of the set {x' (TW((,,)) S e) and LB is a strict lower bound of DTW. Thus, we conclude that any point x' with DTW (z, x') S must satisfy ||æ² - x|| < r, where the certification holds.
Building upon Lemma we present the theorem that establishes DTW-certified robustness for the smoothed function. Formally, we define the anomaly score function f X - IR of a time- series anomaly detector d: X y, and construct a percentile smoothed version of f. denoted as hp : X' + I, which serves as the new anomaly score function of d. The DTW-certified robustness of d can then be derived through the following theorem.
Theorem 3.3 (Robustness Certification for Time-series Anomaly Detection). Let f - I be any deterministic or random function, and 1J ~ NN(0, T)... Let the percentile smoothed function hpp X - R be defined as in Equation 44. Suppose the anomaly score threshold is %, and the following satisfied for a testing input x
hg(()) >1 (fg(()) >? (pp(x)
(9)
Sn. (f)(() S7
Then d(xx) = d(x) is guaranteed to hold all fa': DTW (z, < e}. where
0,
ifr $ R,
(10)
v M2 + 2 R2 - M, ifr R,
with
A, = max (U, Ii, x4 -L:), R=
|A11
M = max | 1si5n
( 1 (p))
(h₂(()) >7 (h)
10 (p) --1)))))-()))
S7
5

---

DTW-Certifled Anomaty Detector
Monte-Carlo Sampling
Perdiction & Certification
Anomaly Benign
Gaussian Noise 1
DTW-Based Certification
Denoise
DTW Rohust Certificate
Time-Series Data
Amomaly Score Function
Percentile Smoothed Amomaly Score Function An
Figure Construct any anomaly detector with anomaly score function f as a DTW-ccrtified detector.
where U and L are envelopes in the Keogh Lower Bound with wrapping window size as specified in Equation (6).
Proof. We provide a sketch of the proof below due to space constraints, and the complete proof is available in Appendix B
We begin by showing that d(xx' d(x) holds for all x' satisfying ||+ |
using Lemma 3.1
The radius r can be solved
a (p- -- (p)) or r o ( (p) depending on the classification outcome. Next, we invoke Lemma 3.2 to translate the certificate from f--norm r to DTW distance e, defined lower bound of the DTW distance. In the final step, we instantiate LB(x, x') with the Keogh Lower Bound, which satisfies the strictness condition for all >> 0 and x' * xr and derive the corresponding expression for by exploiting the structural properties of the upper and lower envelopes U and L.
inf(LB(a x²) x x'll > r]. where LB(x, x') ) strict
3.3 DTW-Certified Defense Implementation
Construet smoothed detector Given an anomaly detector with an anomaly score function f. we construct the percentile-smoothed anomaly score function hp by the definition of Equation (4) following the process as shown in Figure 2 Specifically, the smoothed function is composed as
hp & f. where the smoothing noise ~ NO,, o²I) injection layer j generates multiple Gaussian Gaussian-perturben perturbed inputs x + 7) from the original time-series æ, and the denoising layer λ reduces noise variance to improve score concentration. This denoising process does not compromise the certification guarantee, as randomized smoothing valid for any downstream pipeline (54). For each testing input x, the DTW-certified anomaly detector outputs a binary decision based on anomaly score hp (z) and computes the corresponding certified DTW radius by the Theorem 3.3 This method does not require modifications to the training process and can be readily applied to pre-trained models.
Bound (x) and (1) We utilize Monte-Carlo sampling to estimate and bound the upper and lower percentiles hz(x) and hz(x). following a similar approach as in [88 [5]. Given n i.i.d. Gaussian noise samples {.I,-.. }, we compute anomaly scores X; = f(z + ps) and sort them to obtain the empirical order statistics -0 Kg S KI.... < Kn, < Kn+1 = co. We aim identify K'" and K2 such that Pr[K,- > h=(x)] 1 - a and Pr[K,' < hz)) > 1 - a for a confidence level of (we set a = 1e-3 in the experiments). The corresponding probabilities are evaluated using the binomial distribution
j=9"
Pr[Kg- hr(x))
Σ
(p) -)-
(11)
A similar formula applies for the lower bound. We binary search to identify the smallest q" and largest g¹ that satisfy the required confidence bounds. In general, increasing the number of samples improves the estimation accuracy of the certified radius, and greater consensus aggregated predictions indicate a stronger certification.
4 Experiments
In our experiments, we evaluate the general applicability of the DTW-ccetifiid defense across range of anomaly detection models and time-series datasets. We demonstrate improved robustness

---

compared to Eg no-morm certified defenses and provide ablation studies to analyze the trade-off between detection performance and certified robustness.
Settings Our empirical evaluation of the DTW-certified defense spans seven widely used benchmark datasets, including SMAP
48), MSL [27 SML 60), NIPS-TS-SWAN
NIPS-TS-WATER 33 UCR-1 ane UCR-2 [68, encompassing both univariate and multivariate time-series data. Detailed descriptions and dataset statistics are provided in Appendix [D] To ensure broad applicability, we evaluate our approach using three state-of-the-art anomaly detection models: COUTA 771). TimesNet [67], and DeepSVDDTS
VDDTS [S]]. The effectiveness is further validated through
comparison with nn-orrm certified defense [18] under DTW-based adversarial attack (6).
We use the following default hyperparameters across all experiments unless otherwise specified: sequence length T = 50, DTW wrapping window size w = 4, number of noisy samples n = 1, 000, smoothing noise level 0.5 in (0, o² IT, and percentile p 0.5 in the percentile-smootteed function hp. Additional ablation studies on the hyperparameters are available in Appendix (F)
All experiments are implemented using PyTorch and executed on Linux server equipped with Intel(R) Xeo Gold 6326 CPUs and NVIDIA A100 GPUs with 80 GB of memory.
Evaluation Metrics For evaluating the detection performance, we report the point-adjusted F1- score and Area Under the Receiver Operating Characteristic Curve (ROC AUC) following the
common practice in the domain of time-series anomaly detection 50 58 59
34
71
51 67
To evaluate certified robustness, the certified radii computed for all test instances. Additionally, we report the certified proportion (prop.), defined as the fraction of test inputs with non-zero certified radius
report the mean, maximum, and standard deviation (std.) of
Following the notion of certified accuracy from the certified robustness literature 18 which is defined as the proportion of instances for which the model guarantees correct predictions within specified attack budget as radius 1. We extend this evaluation to the confusion matrix components by considering worst-case adversarial scenarios. Specifically, for evasion attacks, we define Certified True Positives (TP) as the count of true positive instances for which the model
provably robust within a DTW radius of t as Ex I (Vz'' : DTW(2,, S t: f(z²) = 1, y; = 1}. Similarly, for availability attacks, we define the Certified True Negatives (TN) as the number of benign instances that remain correctly classified under all perturbations within the DTW radius as EN I {Vz'= DTW DTW(x; xx) S :t: f(x')= 0, y; = 0}. We construct the corresponding certified confusion matrix as detailed in Appendix E and derive the certified metrics, certified accuracy and certified Fi-score that represent the guaranteed performance under bounded attack.
1==1
4.1 Results
The DT weeetiffeeed defense is broadly applicable, though the certified robustness performance varies across datasets and models. We evaluate the applicability of our DeW-certified defense across benchmark datasets and anomaly detection models. As shown in Table I. our approach generally achieves strong certified robustness with minimal trade-offs in detection performance. For instance, on the NIPS-TS-WATER WATER using DeepSVDDIT
method certifies 99.469 49.46% of test inputs with an average certified robust radius of 0.189, without any degradation in F1-score and ROC AUC. Additionally, DeepSVDDTS often achieves the strongest performance, which we attribute to its superior handling of noisy data. However, we observe weaker robustness on certain datasets, such as SMAP and NIPS-TS-SWAN due their high channel dimensionality and greater data variance, which reduces the tightness of the lower-bound estimation and thus limits certifiable robustness.
Figure presents the certified F1-score and certified accuracy of the COUTA model the MSL and SMAP datasets under evasion and availability attacks. The x-axis denotes the attack budget radius t, while the y-axis shows the corresponding certified metrics. These curves represent lower bounds on model performance under the worst-case adversarial perturbations constrained by DTW (1, S t, guaranteed by DeW-ccetified defense. With appropriately chosen hyperparameters (e.g.. o = 1.0), the defense exhibits strong certified robustness. For instance, on the SMAP dataset, maintains certified F1-score of approximately 0.5 under an evasion attack with a budget of ( = 0.2.
Improved performance over f,-norm certified defense. Table 2 evaluatee the effectiveness of our DTW certiietiiidd defense under strong based adversarial attacks [6]. The adversary is granted
7

---

Cersited
0.6
0.8
0.4
Evasion Attack
gm0.5
0-10
0-0.1
Cartited Accuracy
0.9
1.0
Evasion Attack
0m0.5
0-1.0
0-0.1
Ceraifeed
00.8
0.5
1.0
Evasion Attack
0-0.1
0m0.5
0-100
Cartited Accuracy
1.0
Evasion Attack
om0.5
0-1.0
0-0.1
0.2
0.9
0.2
0.9
0.9
0.4
0.0
0.2
0.4
0.0
0.2
0.4
Attack Budget Radius
Attack Budget Radius
Attack Budget Radius
Attack Budget Radius
Availability Attack
Availabilty Attack
Availablity Attack
Availability Attack
0.8
0-0.1
Cartilee Accuracy
1.0
0-0.1
0-0.1
Certifeed Accuracy
0-0.1
Certiited 11
0.6
0=0.5
gm1 1.0
0.6
0.8
0=0.5
0m1.0
Certifted
0.6
0..
0=0.5
1.0
0.8
0m1.
0:0.5
0.4
0.4
0.4
0.4
0.2
0.2
0.2
0.0
0.2
0.0
Afrack Budget Radius
Artack Budget Radius
Attack Budiett Radius
Budget Radius
(a) Certified metries evaluated on the MSL dataset.
(b) Certified metrics evaluated on the SMAP dataset.
Figure 3: Certified aceuracy and certified Fi-score as functions of the DTW perturbation threshold t E [0.0, 0.5) under evasion or availability attack. Results are reported for the COUTA model on the MSL (a) and SMAP (b) datasets across varying values of the hyperparameter d.
DTW-Certifeed Defense Model
Datased
Model
Detection Performance F1-srore
Performance Delection
Certified Robustness (Radii Stalisties)
ROC AUC
F1-score
ROC AUC
Radii Mean
Radii Max
Rodii Std.
Certified Prop.
COUTA
0.794
0.958
0.961
0.55
0.037
0.816
0.043
51.00%
SMAP
TimesNet
0.783
0.929
0.910
0.992
0.039
1.001
0,044
51.00%
DeepSVDITS
0.861
0.719
0.964
0.052
0.626
0.055
53.55%
COUTA
0.624
0.966
0.833
0.386
0.000
19.9999
SMD
TimesNet
0.877
0.955
0.755
0.961
0.032
0.267
0.036
56 6969
DeepSVDDTS
0.725
0
0.733
0.957
0.255
2,318
0.150
03.94%
COUTA
0.11
0.993
0.206
0.966
0.057
0.534
0.062
55 65.92%%
MSL
TimesNet
0.744
0.956
0.910
0.992
0.056
0.262
0.056
62.18%
DeepSVDDTS
0.973
2.317
0.139
73.89%
COUTA
0.788
0.738
0.710
0.574
NIPS-TS-SWAN
TimesNer
0.770
0.906
0:775
0.866
0.015
0:451
0.080
10.508
DeepSVDDTS
0.740
0.827
0,744
0,830
0.227
2,242
0.196
71.05%
COUTA
0.192
0.900
0.003
0.300
0.232
0.450
0,046
99.86
NIPS-TS CREDDTTCRRD
TimesNet
0.422
0.942
0.450
0.546
0,028
0.262
0.035
51.75%
DeepSVDDTS
0.152
0.772
0.119
0.719
0.817
0.056
91.55%%
COUTA
0.598
0.980
0,070
0.359
95
NIPS-TS-WATER
TimesNer
0.778
0.997
0,550
0.974
0.120
0:279
0.032
99 07.077
DeepVVDDT
0,512
0,764
0,513
0.907
0.189
0,540
0.039
99, 99.46%
COUTA
0.672
0.986
0.949
0.999
0.177
0:413
0.124
69 43.4
UCR-1
TimesNet
0.996
01011
25
DeepSVDDTS
0.981
0.758
COUTA
0
0.998
0.842
0.939
0.022
0,190
0.033
38 8.%
UCR-2
TimesNer
0.984
1.000
0.982
1,000
0.036
0.256
0.042
$2.15%
DeepSVDDTS
0.118
0.900
0.306
0.570
0.033
0.218
0.043
46.02%
Table Detection performance and certified robustness of the DTW-certified defense across various datasets and models with hyperparameter a = 0.5. The results show minimal degradation in detection performance while consistently achieving meaningful DTW-certified robustness.
generous attack budget of catt 1.0, which exceeds the average certified radius of 0.5 measured by both f,-norm and proposed DTW-ccrtified defenses across datasets for model COUTA. As shown in Table 2 the DTW-based adversarial attack is highly effective against undefended models, causing significant drops in Fl-score and ROC AUC (c.g.. a 60.6% drop in Fl-score on SMD and 89.7% on UCR-1). While the lp f--norm certified defense offers partial resilience, it fails to provide consistent protection, especially on datasets with strong temporal distortions under attacks (c.g., SMD and HIPS-TS-WATER: In contrast, our DTW-certified defense consistently outperforms both baselines under attack, yielding substantially higher F1 F1-scores and AUCs. For example, on MSL. and UCR-1, method improves the F1-score under attack by 11 1..2% and 18,7% respectively, compared to the f,.-norm certified defense. These results affirm that robustness guarantees aligned with DTW-rather than f--norm- are essential for effective defense in time-series anomaly detection.
Trade-off between detection performance and certified robustness. We investigate the trade-off between detection performance and certified robustness by varying the hyperparameter o, which
8

---

Unatfacked
Under DTW-haaed Adversarial with Budget San
Dataset
Base Model
Undefended Base Model
4,norr Certified Defeuse
DTW-Certifed Defense
Fl-score
ROC AUC
Flescore
ROC AUC
Flacoure
ROC AUC
Flacure
ROC AUC
MSL
0.896
0.992
0.694
0.938
0.672
0.943
0.784
0.966
SMD
0.575
0.938
0.253
0.698
0.392
0.741
0.464
0.838
NIPS-TS-W NIPS-TS-WATER UCR-1
0.516
0.240
0.665
0.797
0.525
0.927
0.682
0.987
0,084
0.846
0.761
0.893
0.948
0.998
Table Detection performance under DTW-based adversarial attacks, evaluated using the COUTA model across multiple datasets. Comparisons are made among the undefended base model, the nn-norm certified defense, and the proposed DTW-certified defense.
DTW-Certiled Defense
Detection Performance F1-score
Robustness (Radii Statisties)
ROC AUC
Radii Mean
Radil Max
Radii Std.
Certified Prop.
0.1
0.956
0.997
0.007
0.320
0.010
41.13%
0.961
51.0%%
0.961
0.998
1.051
2.0
0.913
0.958
0.202
1.571
0.165
72.24%
0.504
0.881
0.025
0.190
0.024
52.42%
77.99%
SMD
1.0
0.673
0.977
0.121
0.511
0.084
83. 53.28%
2.0
0.315
0.822
0.456
1.969
0.285
94.66%
11.13%
MSL.
1.D
0.830
0.706
0.966
0.984
0.108
0.534
0.457
01099
6A. 27%
12255
2.0
0.739
0,144
0,294
1,457
0.196
87.72%
NIPS-TS-WATER WATER
NIPS-TS
L.D
0.598
0.555
0.986
0.989
0.161
0.070
0:130
0.359
0.061
0.034
95.18%
98, 98.79%
2.0
0.462
0.983
0,261
0.711
0.114
98.54%
UCR-1
0:5
0.949
0.999
0.177
0.415
0.124
69 43%%
1.0
0.919
0.984
0.300
0.692
0.196
75.3656
1.209
%
Table 3:
Detection performance and certified robustness results evaluated under varying o {0.1, 0.5, 1.0, using COUTA. Higher o generally yield improved certified robustness (Mean, Max, Prop.), but could at the expense of reduced detection performance (F1-socre ROC AUC).
controls the magnitude of Gaussian noise o0) used in the smoothing process. Notably, under moderate setting (a 0.5). many configurations exhibit improved detection performance compared to the base model, as shown in datasets SMAP and UCR-1 in Table [1] This observation is consistent with prior work [8] 73, 3 26), where smoothing shown to enhance generalization by stabilizing decision boundaries. As illustrated in Table increasing generally improves certified robustness, as reflected in larger average certified radii and a higher proportion of certified inputs. However, overly large values (e.g., 2.0) often degrade detection performance, including both Fl-score and ROC AUC, Therefore, the choice should be tuned carefully, considering both the model architecture and dataset characteristics.
5 Conclusion and Limitations
We present the first certified defense for time-series anomaly detection under the Dynamic Time Warping (DTW) distance-a metric well-suited for capturing temporal structure in time-series data. By adapting randomized smoothing and leveraging the Keogh lower bound, we derive a DTW- certified radius that provides formal robustness guarantees. This method is model-agnostic across diverse datasets and architectures. Empirical results demonstrate that it consistently delivers strong DTW-certifid robustness while maintaining strong detection performance.
The Monte Carlo sampling process introduces testing-time overhead, which future work may address by exploring more efficient sampling strategies adaptive noise injection methods. Additionally, tightening the DTW relaxation by incorporating more precise lower bounds could lead to stronger robustness guarantees. Finally, extending the proposed framework to broader time-series tasks, such as classification, presents promising direction for future research.

---

Acknowledgements
We thank Dr. Tarun Soni and Kerry Brown for their helpful discussions and valuable feedback. Sarah Monazam Erfani is in part supported by the Australian Research Council (ARC) Discovery Early Career Researcher Award (DECRA) DE220100680.
References
[1] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey, IEEE Access, 6:14410-14430, 2018.
[2] Naveed Akhtar, Ajmal Mian, Navid Kardan, and Mubarak Shah. Advances in adversarial attacks and defenses in computer vision: A survey. IEEE Access, 9:155161-155196 2021.
[3] Jean-Baptiste Alayrac, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? Advances in Neural Information Processing Systems, 32, 2019.
[4] Julien Audibert, Pietro Michiardi, Frédéric Guyard, Sébastien Marti, and Maria A. Zuluaga. Usad: Unsupervised anomaly detection multivariate time series. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, KDD '20, page 3395-3404, New York, NY, USA, 2020. Association for Computing Machinery.
[5] Taha Belkhouja and Janardhan Rao Doppa. Adversarial Framework With Certified Robustness for Time-Series Domain via Statistical Features. Journal of Artificial Intelligence Research, 13:4411-4 apr 2022. arXiv:2207 .0430 [cs].
[6] Taha Belkhouja, Yan Yan, and Janardhan Rao Doppa. Dynamic time warping based adversarial framework for time-series domain. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(6): 2022.
[7] Ane Blazquez-Garciaa Angel Conde, Usue Mori, and Jose Lozano. A review out- lier/anomaly detection in time series data. ACM computing surveys (CSUR), 54(3):1-33, 2021.
[8] Yuanpu Cao, Lu Lin, and Jinghui Chen. Adversarially robust industrial anomaly detection through diffusion model. arXiv preprint vrXiv:2408.04833 2024.
[9] Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv: /902,0670, 2019.
[10] Nicholas Carlini and David Wagner. Towards Evaluating the Robustness of Neural Networks. In 2017 IEEE Symposium on security and privacy (sp). pages 39-57. IEEF, 2017.
[11] Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. Adversarial attacks and defences: A survey. arXiv preprint arXiv:1810.0000 2018.
[12] Pin- Yu Chen and Cho-Jui Hsieh. Adversarial robustness for machine learning. Academic Press, 2022.
[13] Wenchao Chen, Long Tian, Bo Chen, Liang Dai, Zhibin Duan, and Mingyuan Zhou. Deep variational graph convolutional recurrent network for multivariate time series anomaly detection. In International conference on machine learning, pages 3621-3633. PMLR, 2022.
[14] Ping-yet Chiang, Michael Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detection regression: Certified object detection with median smoothing. Advances in Neural Information Processing Systems, 13:1122-1286, 2020.
[15] Ping-yeh Chiang, Michael J. Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detection as Regression: Certified Object Detection by Median Smoothing, feb 2022. arXiv:2007.03730 [cs].
10

---

[16] Kukjin Choi, Jihun Yi, Changhwa Park, and Sungroh Yoon. Deep learning for anomaly detection time-series data: Review, analysis, and guidelines. IEEE Access, 9:120043- 1200665, 2021.
[17] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 1310-1320. PMLR, 09-15 Jun 2019.
[18] Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified Adversarial Robustness via Randomized Smoothing. arXiv: 1902.02918 [cs, stat], jun 2019. arXiv: 1902.02918.
[19] Hui Ding, Goce Trajcevski, Peter Scheuermann, Xiaoyue Wang, and Eamonn Keogh. Querying and mining of time series data: experimental comparison of representations and distance measures. Proceedings of the VLDB Endowment, 1()):1542-1552, 2008
[20] Yinpeng Dong, Zhijie Deng, Tianyu Pang, Jun Zhu, and Hang Su. Adversarial distributional training for robust deep learning. Advances in Neural Information Processing Systems, 33:8270- 8283, 2020.
[21] Hossein Estiri, Zachary H Strasser, Jeffy G Klann, Pourandokht Naseri, Kavishwar B Wagho- likar, and Shawn N Murphy, Predicting covid-19 mortality with electronic medical records. NPJ digital medicine, 4(1):15, 2021.
[22] Thomas Fischer and Christopher Krauss. Deep learning with long short-term memory networks for financial market predictions. European Journal of operational research, 27062):654-669, 2018.
[23] Nicola Franco, Daniel Korth, Jeanette Miriam Lorenz, Karsten Roscher, and Stephan Guenne- mann. Diffusion denoised smoothing for certified and adversarial robust duitr--diistibution detection. arXiv preprint 2rXiv:2303.149611 2023.
[24] Tomasz Górecki and Maciej Luezak. Non-isometric transforms in time series classification using dtw. Knowledge-base systems, 61:98-108, 2014.
[25] Hrayr Harutyunyan, Hrant Khachatrian, David C Kale, Greg Ver Steeg, and Aram Galstyan. Multitask learning and benchmarking with clinical time series data. Scientific data, 6(1):96, 2019.
[26] Miklós Z Horváth, Mark Niklas Müller, Mare Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. arXiv preprint arXiv:2106.06944 2021.
[27] Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. Detecting spacecraft anomalies using Istms and nonparametric dynamic thresholding. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD '18, page 387-395, New York, NY, USA, 2018. Association for Computing Machinery.
[28] Eamonn Keogh and Chotirat Ann Ratanamahatana. Exact indexing of dynamic time warping. Knowledge and information systems,
2005.
[29] Sultan Uddin Khan, Mohammed Mynuddin, and Mahmoud Nabil. Adaptedge: Targeted universal adversarial attacks on time series data in smart grids, IEEE Transactions on Smart Grid, 2024.
[30] Kwei-Herng Lai, Daochen Zha, Junjie Xu, Yue Zhao, Guanchu Wang, and Xia Hu. Revisiting time series outlier detection: Definitions and benchmarks. In Thirty-fifth conference on neural information processing systems datasets and benchmarks track (round 1), 2021.
[31] Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. arXiv preprint arXiv:2006. /2655, 2020.
[32] Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified Robustness to Adversarial Examples With Differential Privacy. arXiv: arXiv:1802.08:: 1802.03471 [cs, stat], may 2019, arXiv: 1802.03471.

---

[33] Bai Li. Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified Adversarial Robustness With Additive Noise. 180.:0811033133 [cs, stat], nov 2019. arXiv: 1809.03113.
[34] Hui Li, Yunpeng Cui, Shuo Wang, Juan Liu, Jinyuan Qin, and Yilin Yang. Multivariate Financial Time-Series Prediction With Certified Robustness. IEEE Access, 8:109133-109145, 2020. Conference Name: IEEE Access.
[35] Shuyang Li, Gianluca Francini, and Enrico Magli. Temporal dynamics clustering for analyzing cell behavior in mobile networks. Computer Networks, 223: 109578, 2023.
[36] Zhihan Li, Youjian Zhao, Jiaqi Han, Ya Su, Rui Jiao, Xidao Wen, and Dan Pei. Multivariate time series anomaly detection and interpretation using hierarchical inter-metric and temporal embedding. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pages -220-3230, 2021.
[37] Jason Lines and Anthony Bagnall. Time series classification with ensembles of elastic distance measures. Data Mining and Knowledge Discovery, 29:565-592, 2015.
[38] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv preprint arXiv:1706.0608 2017.
[39] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv:1706.0000 0708.0080333.. [cs, stat], sep 2019. arXiv: 1706.06083.
[40] Mohsin Munir, Shoaib Ahmed Siddiqui, Andreas Dengel, and Sheraz Ahmed. Deepant: A deep learning approach for unsupervised anomaly detection time series. IEEE Access, 7:1991-2005, 2018.
[41] David MQ Nelson, Adriano CM Pereira, and Renato A De Oliveira. Stock market's price movement prediction with Istm neural networks. In 2017 International joint conference on neural networks (LJCNN), pages 1419-1426. IEEE, 2017.
[42] Guillermo Ortiz-iiménez, Apostolos Modas, Seyed-Mohsen Moosavi-Dezfooli and Pascal Frossard. Optimism in the face of adversity: Understanding and improving deep learning through adversarial robustness. Proceedings of the IEEE, 109(5):635-55, 2021.
[43] Ambar Pal and Jeremias Sulam. Understanding noise-augmented training for randomized smoothing. arXiv preprint S.ti:22305.0744:5 2023.
[44] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks. In 2016 IEEE Symposium Security and Privacy (SP), pages 582-597. IEEE, 2016
[45] Zhuang Qian, Kaizhu Huang, Qiu-Feng Wang, and Yao Zhang. A survey of robust ad- versarial training in pattern recognition: Fundamental, theory, and methodologies. Pattern Recognition, 131: 101:198889, 2022.
[46] Alvin Rajkomar, Eyal Oren, Kai Chen, Andrew M Dai, Nissan Hajaj, Michaela Hardt, Peter J Liu. Xiaobing Liu, Jake Mareus, Mimi Sun, al. Scalable and accurate deep learning with electronic health records. NPJ digital medicine, 1(1):18, 2018.
[47] Toni M Rath and R Manmatha. Lower-bounding of dynamic time warping distances for multivariate time series. University of Massachusetts Amherst Technical Report MM, 40:1 40:1-4, 2002.
[48] Rolf Reichle, Gabrielle De Lannoy, Randal Koster, Wade Crow, John Kimball, Qing Liu, and Michel Bechtold. Smap 14 global 3-hourly 9 km ease-grid surface and root zone soil moisture geophysical data, version 8, 2025.
[49] Hansheng Ren, Bixiong Xu, Yujing Wang, Chao Yi, Congrui Huang, Xiaoyu Kou, Tony Xing, Mao Yang, Jie Tong, and Qi Zhang. Time-series anomaly detection service at microsoft. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining, pages 4009-3017, 2019.
12

---

[50] Hansheng Ren, Bixiong Xu, Yujing Wang. Chao Yi, Congrui Huang, Xiaoyu Kou, Tony Xing. Mao Yang, Jie Tong, and Qi Zhang. Time-series anomaly detection service at microsoft. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery Data Mining, KDD '19, page 3009-3017, New York, NY, USA, 2019. Association for Computing Machinery.
[51] Lukas Ruff, Robert Vandermeulen, Nico Goernitz, Lucas Deecke, Shoaib Ahmed Siddiqui, Alexander Binder, Emmanuel Müller, and Marius Kloft. Deep one-class classification. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 4393-4402. PMLR, 10-15 Jul 2018.
[52] Hiroaki Sakoe and Seibi Chiba. Dynamic programming algorithm optimization for spoken word recognition. IEEE Transactions on Acoustics, Speech, and Signal Processing, 26(1 (1(1))43444 49, 2003.
[53] Hadi Salman, Jerry Li, Ilya Razenshteyn. Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. Advances in neural information processing systems, 32, 2019.
[54] Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and Zico Kolter. Black-box smoothing: provable defense for pretrained classifiers. arXiv preprint arXiv:2003.01900 2(2). 2020.
[55] Hadi Salman, Greg Yang. Jerry Li, Pengchuan Zhang, Huan Zhang, Ilya Razenshteyn, and Sébastien Bubeck. Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers. Advances in neural information processing systems, page 31, 2019.
[56] Ibraheem Shayea, Abdulraqeb Alhammadi, Ayman A El-Saleh, Wan Haslina Hassan, Hafizal Mohamad, and Mustafa Ergen. Time series forecasting model of future spectrum demands for mobile broadband networks in malaysia, turkey, and oman. Alexandria Engineering Journal, 61(10):8051-8067 2022.
[57] Ryan Sheatsley, Nicolas Papernot, Michael Weisman, Gunjan Verma, and Patrick McDaniel. Adversarial examples in constrained domains. arXiv preprint arXiv:2011.0118 2020.
[58] Lifeng Shen, Zhuocong Li, and James Kwok. Timeseries anomaly detection using temporal hierarchical one-class network. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 13016- 13026. Curran Associates, Inc., 2020.
[59] Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, KDD 119, page 2828-28377 New York, NY, USA, 2019. Association for Computing Machinery.
[60] Yixin Su, Yongxin Zhao, Chao Niu, Rong Liu, Weijie Sun, and Jian Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 2837. ACM, 2019.
[61] Shahroz Tariq, Binh M Le, and Simon S Woo. Towards an awareness of time series anomaly detection models' adversarial vulnerability. In Proceedings of the 31 ACM International Conference on Information & Knowledge Management, pages 3534 3544, 2022.
[62] Chunzhi Wang, Shaowen Xing, Rong Gao, Lingyu Yan, Naixue Xiong, and Ruoxi Wang. Disentangled dynamic deviation transformer networks for multivariate time series anomaly detection. Sensors, 23(3):1 104, 2023.
[63] Wenqi Wang, Run Wang, Lina Wang, Zhibo Wang, and Aoshuang Ye. Towards a robust deep neural network in texts: A survey, arXiv preprint
2019.
[64] Yongfeng Wang and Guofeng Yan. Survey on the application of deep learning in algorithmic trading. Data Science in Finance and Economics, 1(4):345-311, 2021.
13

---

[65] Zhibo Wang, Mengkai Song, Siyan Zheng, Zhifei Zhang, Yang Song, and Qian Wang. Invisible adversarial attack against deep neural networks: An adaptive penalization approach. IEEE Transactions on Dependable and Secure Computing, 18(3):1474-144 2019.
[66] Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey, arXiv preprint arXhv:2312.0888
2023.
[67] Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. In International Conference on Learning Representations, 2023.
[68] Renjie Wu and Eamonn Keogh. Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress. IEEE Transactions on Knowledge and Data Engineering. 35(3):2421-243) 2021.
[69] Tao Wu, Xuechun Wang, Shaojie Qiao, Xingping Xian, Yanbing Liu, and Liang Zhang. Small perturbations are enough: Adversarial attacks time series prediction. Information Sciences, 587:794-812, 2022.
[70] Fengli Xu, Yuyun Lin, Jiaxin Huang, Di Wu, Hongzhi Shi, Jeungeun Song, and Yong Li. Big data driven mobile traffic understanding and forecasting: A time series approach. IEEE Transactions on Services Computing, 9(5):796 8009966--02200 2016.
[71] Hongzuo Xu, Yijie Wang, Songlei Jian, Qing Liao, Yongjun Wang, and Guansong Pang. Calibrated one-class classification for unsupervised time series anomaly detection. arXiv preprint arXiv:2207.12200 2022.
[72] Greg Yang, Tony Duan, J. Edward Hu, Hadi Salman, llya Razenshteyn, and Jerry Li. Random- ized Smoothing of All Shapes and Sizes. Proceedings of the 37th International Conference on Machine Learning, pages 10693-10705. Pmir, nov 2020. Issn: 2640-3498.
[73] Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In International Conference on Machine Learning, pages 10693-10705. PMLR, 2020.
[74] Wenbo Yang, Jidong Yuan, Xiaokang Wang, and Peixiang Zhao. Tsadv: Black-box adversarial attack on time series with local perturbations. Engineering Applications of Artificial Intelligence, 1 114: 105218, 2022.
[75] Chengyuan Yao, Pavol Bielik, Petar Tsankov, and Martin Vechev. Automated discovery of adaptive attacks on adversarial defenses. Advances in Neural Information Processing Systems, 34:26858 26870, 2021.
[76] Wei Emma Zhang, Quan Sheng, Ahoud Alhazmi, and Chenliang Li. Adversarial attacks on deep-learning models in natural language processing: A survey, ACM Transactions Intelligent Systems and Technology (TIST), 11(3): 111, 2020.
14

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The paper's contributions and underlying assumptions are clearly stated the end of the abstract and in the concluding paragraph of the introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of this work are discussed in Section
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
15

---

Justification:
The theoretical results in this paper are provided with full set of assumptions and complete proof as in Section 3.2 and Appendix B
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
The implementation details to reproduce the algorithm are provided in Sec- tion 3.3 the experiments settings are provided in Section 4
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
16

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The code and environment file are provided in the supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips //ipss.cc/pill wttpcccpppppppppeeeeeeeeeeeeeeee httpa///guddeee/eeeeabiiissssss /Cc////oddiiisssseeeeeee ssi.iiliccyyyyyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification: he training and testing details are provided in Section Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: The statistical significance of the experiments are discussed in Section Evaluation Metrics.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
17

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: The computational resources used for the experiments are specified in Section Settings.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: This research was conducted in accordance with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The broader impacts are discussed Appendix G
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
18

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper does not release new data models.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
The data and models used in the paper are properly cited detailed in Section
Justification:
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
19

---

If assets are released, the license, copyright information, and terms of use in the thcode. has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
package should be provided. For popular datasets, paperswi
latasets.paperssi
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM for what should or should not be described.
21

---

A Randomized Smoothing Details
was originally proposed and widely applied in classification tasks by constructing the smoothed function g(x) that takes the Gaussian means of the base function f as
Randomized smoothing [77
(zx) o0) 1f) + n)]
(12)
Lemma A.1. Given a bounding output range as f - [1, u), the upper and lower bounds on the output of the Gaussian smoothed function g(2') can be shown (14)
1+ (u 1) - k(z)
2|
2'112
S g((') ( (u (0-1)))10) Mxx))
+ || x' x'112
(13)
σ
where k(xx) 0 standard Gaussian distribution.
( and 4 denote the cumulative distribution function (CDF) of the u-1
In the context of classification, g(z) is interpreted as the bounded probability score in range [0, for each label, e.g., the softmax score, and a certificate can obtained by bounding the gap between the highest and second-highest scores.
B Proof of Theorem 33
Here we provided the complete proof of the Theorem 3.3
Proof. First, we prove that d(x') = d(x) holds for all x' satisfying || - x'1l I r. In the case of d(x) 1, i.e., hr(x) > 7, we prove that all x' satisfies h,(2²) 7. Given the inequality hx(x) < hx(x') for all | 22112 < r, as established in Lemma 3.1 it follows that if hp(2)) > then < ha(()) < hp(aa), which ensures that hx(x") > y- In the case of d(x:) 0, the proof follows
by similar argument. The radius r can be solved by the definitions of p 4 (p) :) and p = 2 + +) as given in Lemma 3.1
By Lemma 3.2 such certification can be transited to {x' | DTW (x,xx) S e) by solving the inf(LB((, x') || - x'|| > r with a proper choice of the lower bound LB(x, x²).
We consider the Keogh Lower Bound (28) LB_ I.B_Keog([r, Keogh(zr,x") x'), which is strict lower bound of DTW for any w > 0 and x' * x. The LB [e_KKoghh(z, x²) is calculated as the sum deviation of x' outside the envelope of ær For each time step we define the slack (allowable deviation) without incurring any penalty in LB K Keogh(x, x²) by A; = max(U;
Zi, H; - -.)) and the sum of all time steps as R= VΣ - A. Thus, if x' could "hide" all the norm deviation within the slacks for all time steps as r < R. the LB K Keogh(z, x') = 0. Hence, in that case, e == 0.
Then consider the case when > R, which means any x' with || par-20 x'|l one coordinate outside the envelope. Since we are solving for the infimum, the smallest possible LB K Keogh(z, (z. x²) is when ||æ x''l and the x' use up the available slack A in every coordinate except one i" where the slack A,- is largest. Then, such a worst-case is defined as
must have at least
x + Ai 3a + D,- + d, if
if
(14)
with d as the part outside the envelops and || - x'll = r. In that case
2 = || 21112
Σ |A + +|A,- 2
Σ
A
+ 2 d' A.-
+ +|dl?
(15)
Note that the LB Keogh(æ, x') is calculated as the sum of deviations outside the envelope. Thus, the infimum when > R can be obtained by solving ||d]]. To yield the extreme value of |[d]] d and A,- should be collinear and can be written as d = AA,-. With the substitution, the equation becomes
(X² + 2X)M² + R²=
(16)
22

---

Solve for the X, we have
p2 R2
A= 1+
(17)
M²
Therefore, the infimum value of ||]]| is
|||| = V M2 + +
R
M =
(18)
C Extension to lp Norm
Generalization of Randomized Smoothing to Arbitrary Norms Our certified robustness analysis in the main text is built upon randomized smoothing under the & norm using Gaussian noise. The framework naturally extends to arbitrary Lp norms by replacing the isotropic Gaussian distribution with a noise distribution that radially symmetric with respect to the chosen norm
llp denote the base norm and || llg its dual norm, where + 9 1. We consider a noise vector drawn from a distribution that is spherically symmetric with respect to || -Ilz- such that the density of 1) depends only on || where Gaussian noise 77 ~ (0, o²1); l with Laplace noise тІ Laplace b) i..d.; loo with Uniform noise 7) Unif[ -T, r] i..dd General lp can use generalized Gaussian noise with density proportional expp(=Innll)/// X²) for p.
72
Let ||
scale parameter. Typical choices include: &a with
Quantile Stability under é, Perturbations Let f denote the base anomaly scoring function and hx(x)) the p-th percentile of f(x 17) under the smoothing noise distribution. For any 2 0, define as the cumulative distribution function of (u, 17) for any unit vector u with ||u||ş = 1. Then, the following holds for all || z|Ip S::
(19) Equation 19) generalizes the Gaussian case by replacing the standard normal CDF & with the 1-D marginal F the chosen noise distribution, and the Gaussian scale o with the corresponding scale parameter This yields certified radius in e, norm space.
hF(F (2') I hp(2) S hF(F (())+)/a)(=))
DTW Certification via é, Lower Bounds The DTW-based certification derived in Lemma 3.2 remains valid once & is replaced by ly- Specifically, let Lekeghh.p (x,x²) denote strict lower bound of (x,,(x; x²). For any perturbation || xllp S r, the certified DTW radius
ep
inf LB o (z, x') || x1pp > r..
(20)
A practical closed-form lower bound can be obtained via
2 (r
RP m.
(21)
where Rin.p is the largest Ep ball centered at fully contained within the envelope [T., U] used in the T.Bgeogh.p construction. This provides conservative yet efficient computation of certified DTW radius for arbitrary norms.
This extension preserves the overall structure of the certification pipeline:
1. Replace Gaussian noise with a norm-symmetric distribution;
2. Replace the Gaussian CDF & by the 1-D marginal CDF F of that noise;
3. Compute the é, certified radius r via (I)):
4. Translate the Ep certificate into DTW certificate ep using 20
This demonstrates that the proposed percentile-based randomized smoothing framework is inherently norm-agnostic, supporting robustness certification under any Ep metric and its induced DTW variants.
D Dataset Details
The Soil Moisture Active Passive (SMAP) dataset measurements collected by NASA's Mars rover.
contains soil moisture and telemetry
23

---

Datasets
Chanmels
Training Timesteps
Testing Timesteps
Testing Anomalles Ratio %
135,183
427,617
13.13%
MSL
55
58,317
73.729
10.72%
SMD
25
708,405
708,420
4. 4.16%
NIPS-TS- SWAN
38
60,000
60,000
32 32.60%
PES-TS-CREDITCARI
29
284,807
284,807
0.17%
NIPS-TS- WATER
9
69,260
69,260
1.05%
UCR-1
35,000
44,795
1.38%
UCR-2
35,000
45,000
0.67%
Table 4: Statistics of the benchmark datasets for time-series anomaly detection.
The Mars Science Laboratory (MSL) dataset 27 includes comprehensive sensor and actuator data
directly obtained from the Mars
The Server Machine Dataset (SMD) [60] offers stacked resource utilization data from 28 machines five-week duration.
within compute cluster, collected
The NIPS-TS benchmark suite 300 and the UCR collection [68 which provide standardized
datasets widely employed in time-series anomaly detection.
E
Certified Confusion Matrix
Predicted Positive
Predicted Negative
Pusitive Negative
Certified TP(() Σ. 1 (Vv. DTW(2,)) st: [(x) 1, 1,41=1 =
(y Certified TP())
FP
TN
Table 5: Certified Confusion Matrix for evasion attacks.
Predicted Positive
Predicted Negative
Positive
TP
Negative
Σ
1 (u Certified TN(()
Certified TN(() L DIW(B.Z)) f(x)) 0,8
Table 6: Certified Confusion Matrix for availability attacks.
Certified accuracy is metric widely used in certified robust machine learning, measuring the fraction of examples for which a model can provably maintain correct predictions under specific perturbations. For certified radius e, it is defined as
N I (Ve' with DTW (x,, Se: f(x') ys}
Certified Accuracy(e)
(22)
N
Following the definition of certified accuracy. we construct the certified confusion matrix described in Section Given the certified confusion matrix, the certified accuracy is computed as the proportion of instances for which the model guarantees correct predictions within perturbation threshold. It is
defined as:
Certified Accuracy Certified TP + Certified TN
(23)
where is the total number of test instances.
Similarly, the certified Fl-score, which balances precision and recall under certification constraints, calculated as:
2 Certified Precision Certified Recall
Certified Fl Certified Precision + Certified Recall
(24)
where
Certified TP
Certified Precision
(25)
Certified TP + FP
Certified TP
Certified Recall
(26)
Certified TP + FN

---

Here, FP and FN refer to false positives and false negatives, respectively, counted as the remaining instances included in the certified true predictions. These metrics provide conservative evaluation of model robustness under worst-case adversarial perturbations.
F
Additional Experiment Results
Seq. Length T
Window Size
Fl-soore
Standard
ROC AUC
Fl-score
ROC AUC
Radii Mean
DTW-Certified Defense
Radii Max
Radii Std.
Certified Prup.
10
0.571
0.856
0.671
0,943
0.855
0.333
0.053
92.59%
10
0.083
0.526
0,054
91.01%
30
4
0.675
0.956
0.624
0
0.083
0.386
0.060
77.99%
10
0.074
0.574
0,061
71.05%
0.131
0,699
0.104
79.69%
100
4
0.656
0.929
0.447
0.878
0.119
0.678
0.107
71.54%
0.107
0.635
63.30%
0.057
0,392
0.076
48.50%
200
0.681
0.963
0..40
0.880
0.050
0.391
0.074
41.05%
0.041
0.389
33.339
Table 7: Empirical and certified robustness results for the SMD dataset using the COUTA model with
a 0.5, evaluated under varying sequence length and DTW wrapping window size w.
Table / presents an ablation study on the impact of sequence length T and DTW wrapping window size to on both detection performance and certified robustness. The results indicate a trade-off between these parameters and robustness guarantees. Increasing the sequence length generally enhances detection performance (F1 (F1-score and ROC AUC) by incorporating more temporal context for anomaly detection. However, this comes at the cost of reduced certified radius, as the higher dimensionality magnifies the impact of injected noise. Similarly, increasing the wrapping window allows greater temporal flexibility in DTW alignment but leads to looser Keogh lower bounds and higher slack (as defined by the value R in Theorem 3.3). thereby weakening the robustness guarantee.
G Border Impact
Time-series anomaly detection plays a crucial role in many safety-critical domains, including health- care monitoring, financial fraud detection, industrial control systems, and mobile communication networks. In such applications, robustness to adversarial manipulation is not only a matter of perfor- mance but also of safety, reliability, and trust. This work contributes to the broader goal of deploying machine learning systems that are resilient to worst-case perturbations in time-series data, particularly those involving temporal distortions.
Our proposed Derticetified defense offers a principled approach to formally quantifying and improving the robustness of anomaly detection systems under realistic threat models. By aligning the certification metric with the temporal structure time-series data, we aim to enable more reliable AI systems in high-stakes environments. However, acknowledge that any advancement in robustness may also encourage the development of stronger adversarial strategies. As such, we encourage responsible deployment and continuous evaluation of these defenses in real-world conditions.
This work is primarily beneficial to organizations secking reliable time-serics analytics in critical domains. It does not disproportionately disadvantage any particular group. Nonetheless, with any security-related research, care should be taken to ensure that the methodology is not misused to benchmark or strengthen attack strategies without accompanying safeguards.
25


Reviews:
[{"review_id": "VLbeIJE0QF", "reviewer": "Reviewer_7Njo", "summary": "The paper introduces the first certified‐robust defense for time-series anomaly detection measured in Dynamic Time Warping (DTW) distance. It adapts randomized smoothing to obtain an ℓ₂-norm certificate and then analytically translates this guarantee to DTW by exploiting the Keogh lower bound, yielding a closed-form certified radius that can be reported at inference time. Because the smoothing wrapper sits on top of any pre-trained detector, the method is model-agnostic and requires no retraining. Empirical tests on seven benchmark datasets and three modern detectors show that the approach maintains high detection accuracy while improving F1 scores against strong DTW adversaries, substantiating both its practicality and theoretical soundness.", "questions": "1. Generality Beyond Euclidean Norms.\nThe paper states that the proposed certificate “readily generalizes to arbitrary norm orders p” (line 125). However, both the theoretical development and the experiments appear tailored to the Euclidean norm. Could the authors provide a concrete derivation for at least one non-Euclidean case (e.g., p=1) and report certified radii on the same datasets?\n\n2. Smoothness Assumption in Lemma 3.1.\nLemma 3.1 hinges on smooth anomaly scores, yet the manuscript does not explicitly state any regularity conditions on the anomaly score function $f$. I encourage the authors to formally state the smoothness or continuity assumptions required for the lemma to hold, and possibly include a brief proof sketch showing that the percentile smoothing preserves these properties.\n\n3. Inference Efficiency and Latency.\nThe proposed method relies on large numbers of Monte Carlo samples (e.g., $n = 1000$ in experiments), which may cause considerable inference latency. It would be helpful if the authors could include measurements of wall-clock latency or throughput, particularly for typical values of $n$.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n1. The paper closes a gap by deriving a formal certificate in Dynamic Time Warping (DTW) distance rather than the usual $l_p$ norms, which are known to mis-characterise temporal distortions. This is positioned as the first such result in this domain.\n\n2. Because the defense is applied post-training (it wraps a pre-trained detector with a smoothing/denoising layer), practitioners can add robustness onto existing systems without retraining.\n\n3. By proving Lemma 3.2 and Theorem 3.3, the authors map any $l_2$-certified radius obtained via randomized smoothing to an explicit DTW radius through the Keogh lower bound. This connection is practically computable.\n\n**Weaknesses**\n\n1. The paper's robustness guarantee quietly depends on the anomaly-score function changing smoothly whenever the input is nudged a tiny bit. The key lemma assumes that adding a small amount of Gaussian noise cannot reorder which inputs look more or less anomalous, something that holds only when the score has no sudden jumps. The three neural network detectors tested in the experiments behave this way, so the proof is valid for them. But any detector that uses hard thresholds, coarse rounding, or aggressive max-pool operations could let its score flip abruptly under minuscule input changes, breaking the guarantee. Therefore, the defense is provably safe only for detectors that produce smooth, gently varying scores, which narrows its general usefulness.\n\n2. The paper's promise that its method can be extended to any distance norm \"with minimal modification\" is not backed up by the proofs. Every step of the theoretical argument is built around ordinary Euclidean distance: the randomized-smoothing lemma protects the model only against perturbations measured in that specific way, and the later conversion from Euclidean radius to a Dynamic-Time-Warping radius depends on algebra and geometric facts that hold only under Euclidean geometry. The authors never supply a new noise-adding scheme, inequality, or optimization path that would make the same guarantee work for other norms, so the statement in lines 124-126 that such a change would be easy remains an unproven claim.\n\n3. Certified prediction relies on huge amounts of Monte-Carlo samples, adding tangible latency that could hinder real-time monitoring.", "was_revised": true, "final_justification": "My concerns have been thoroughly addressed through the rebuttal. I have updated my score accordingly.", "rebuttal": "We sincerely thank the reviewer for the valuable feedback provided. Below, we clarify and address each concern in detail:\n\n**1 Generality to Arbitrary Norm Orders $p$:** Our method builds upon Randomized Smoothing, which has been generalized to arbitrary norm orders $p$ in the cited work \\[73]. In summary, different norm orders can be achieved by adding appropriate noise distributions:\n* Gaussian noise for $p = 2$\n* Laplace noise for $p = 1$\n* Uniform noise for $p = \\infty$\n\nThe proposed DTW-certificate can likewise be generalized to any norm order $p$ (e.g., $p = 1$) by replacing Gaussian noise with the corresponding distribution (e.g., Laplace noise). Regarding the certification process, Lemma 3.2 and its proof remain valid for arbitrary $p$, and Theorem 3.3 requires the following modifications:\n\n1. Redefine the certified radius $r$ from norm-2 to norm-1.\n2. Redefine $R$ from norm-2 to norm-1 as $R = \\sum \\|\\delta_i\\|$.\n3. In Eq. (15), replace the norm-2 expansion with norm-1 expansion: $r = \\sum \\|\\delta_i\\| + \\|d\\|$.\n4. Following the same proof steps, the expression of $e$ in Eq. (10) becomes $e = r - R$.\n\nGiven the limited time, we provide initial results for the norm-1 certification of the COUTA model here (align to Table 1, last 6 columns), and will expand on this discussion in greater detail in Sec 4 of the camera-ready.\n\n| Dataset             | F1-score | ROC AUC | Radii Mean | Radii Max | Radii Std. | Certified Prop. |\n|---------------------|----------|---------|------------|-----------|------------|-----------------|\n| SMAP                | 0.959    | 0.998   | 0.058      | 0.444     | 0.078      | 47.23%          |\n| SMD                 | 0.574    | 0.937   | 0.028      | 0.207     | 0.041      | 62.83%          |\n| MSL                 | 0.818    | 0.970   | 0.027      | 0.496     | 0.075      | 44.23%          |\n| NIPS-TS-SWAN        | 0.738    | 0.795   | 0.012      | 0.432     | 0.032      | 12.97%          |\n| NIPS-TS-CREDITCARD  | 0.652    | 0.919   | 0.054      | 0.322     | 0.073      | 74.34%          |\n| NISP-TS-WATER       | 0.445    | 0.969   | 0.083      | 0.217     | 0.021      | 84.36%          |\n| UCR-1               | 0.974    | 0.999   | 0.040      | 0.300     | 0.018      | 57.25%          |\n| UCR-2               | 0.688    | 0.972   | 0.013      | 0.094     | 0.079      | 19.47%          |\n\n**2 Applicability to Arbitrary Anomaly Score Functions:** Our method and Lemma 3.1 impose no smoothness or continuity assumptions on the anomaly score function $f: \\mathcal{X} \\to \\mathbb{R}$. The proposed approach is applicable to any anomaly score function that is used as described in Section 3.1 (Para. Time-series Anomaly Detector), where the anomaly is identified as an anomaly score that exceeds the threshold. This includes the function output with sudden jumps, such as hard thresholds, coarse rounding, or aggressive max-pool operations. \nThis generality follows from our use of a randomized smoothing approach, which can be applied to any function as one of its key advantages, as established in [17, 14]. \n\n**3 Computational Overhead:** We acknowledge that Monte Carlo sampling introduces computational overhead, slowing inference by approximately a factor of $n$ (the number of noisy samples). The value of $n$ can be user-specified, where a larger $n$ gives a more precise estimation and usually a larger certified radius. \n\nWe would like to note that such overhead is intrinsic to all randomized smoothing methods [32][18][55], reflecting a fundamental trade-off for significantly stronger robustness guarantees. Nevertheless, randomized smoothing is still one of the most efficient and scalable approaches compared to other certified robustness methods [18].    \n\nOur method does not incur any additional cost beyond that of standard randomized smoothing, and reducing sample complexity remains an active research direction. In practice, the overhead can be substantially reduced through parallelization using multiple copies of the anomaly detector.\n\nWe provide additional results on running time overhead, evaluated in the settings as described in Section 4.\n* Normal inference: 1/498s per batch (size 64)\n* Inference and Certification: 1.83s per batch (size 64)\n\nWe sincerely thank the reviewer again for your time and effort. We hope that our responses have clarified the issues raised and kindly request your consideration."}, {"review_id": "umG8d0FnuA", "reviewer": "Reviewer_CMCZ", "summary": "This paper aims to provide provable robustness for time series anomaly detection under Dynamic Time Warping (DTW) distance. The authors argue that existing Lp-norm based certification methods are unsuitable for time series data due to their sensitivity to temporal distortions. Building upon this observation, they propose a novel certification approach that bridges Lp-norm to DTW distance through randomized smoothing and lower-bound transformation. The proposed method is model-agnostic and has been experimentally validated across multiple datasets.", "questions": "See my comments on the weakness.", "limitations": "While the paper introduces a theoretically sound DTW-based certification approach with broad applicability, several weaknesses limit its impact. The comparison with Lp-norm certification is arguably unfair, as DTW-specific attacks inherently favor DTW metrics. Practical effectiveness is questionable, with extremely small verifiable radii (e.g., 0.022) and low certified proportions on key datasets (SMAP, NIPS-TS-SWAN), revealing vulnerability to high-dimensional, high-variance data. The method’s novelty is unclear—it combines randomized smoothing and DTW without sufficiently differentiating from prior work (e.g., median smoothing in [14]) or justifying design choices (e.g., exclusive use of sup function). Presentation issues (missing citations, unclear notation) and weakly articulated contributions further undermine the work. Most critically, experiments lack validation across diverse methods, and performance gains are inconsistent, leaving the method’s added value unconvincing.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. The research problem addressed in this paper is meaningful. Identifying more appropriate robustness metrics (e.g., DTW) for time series data compared to conventional Lp-norm measures represents a valuable research direction.\n2. The model-agnostic nature of the proposed methodology substantially enhances its potential applicability across diverse domains.\n3. The authors propose a novel certification approach that bridges Lp-norm to DTW distance through randomized smoothing and lower-bound transformation, supported by a strong theoretical framework.\n\nWeaknesses：\n1. Although the paper compares with Lp-norm certification, this comparison may not be entirely fair. The DTW attack itself is specifically designed to maximize DTW distance, so it's expected that Lp-norm certification would perform poorly under such attacks.\n2. The results (Table 1) show that on some data sets (such as SMAP, NIPS-TS-SWAN), the mean of the verifiable radius is very small (such as 0.037,0.022), and the certified proportion is not high. This shows that the actual protection ability of the method is very limited on these datasets. Although the explanation (high dimension and large data variance) of this paper is reasonable, it also exposes the vulnerability of the method. \n3. What is the difference between the smoothed anomaly score function and the median smoothing in [14]? Why only the sup function is used to represent this, but no inf function?\n4. A literature citation is required when Dynamic Time Warping first appears in the paper.\n5. X= RL×C should be change to XRL×C\n6. The contributions of abstact and introduction are weak. In the method part, this work simply combines random smoothing and DTW technology, and the contribution of the statement is not fully reflected in the method part. In the experimental part, the feasibility of the theory is not verified in more methods, and the performance improvement brought by the method is not uniform。", "was_revised": true, "final_justification": "My comments are well-addressed , and I would like to raise my score.", "rebuttal": "We sincerely thank the reviewer for the valuable feedback provided. Below, we clarify and address each concern in detail:\n\n**Concern in Weakness 1 \"Comparison with $l_p$-Norm Defenses\":** As discussed in the Abstract and Introduction (lines 30-49), the inadequacy of existing $l_p$-norm certification methods for time-series data, their poor performance under DTW-based attacks, and the complete absence of any prior certified defense against DTW attacks were the primary motivations for developing our proposed DTW-certified defense. The performance gap between $l_p$-norm certification and our DTW-certified defense validates our assumption and clearly demonstrates the superiority of the proposed approach under realistic DTW-based adversarial scenarios.\n\n**Concern in Weakness 2 \"Performance Differences Across Datasets\":** We acknowledge that our certified defense does not achieve identical performance across all datasets. However, it is important to note that no single method/setting achieves optimal performance for all data, and this is a well-known phenomenon in existing certified robustness literature [32][18][55]. \n\nAs discussed in lines 265-267 & 292-298, the variation arises from differences in dataset characteristics and model architectures, particularly their sensitivity to injected noise. Consequently, tuning the noise level is often necessary to achieve optimal certification performance in each setting.\nFor example, on SMAP (COUTA), the mean certified radius is $0.037$ with a certified proportion of $51.06$% at noise level $0.5$ (Table 1), but improves to a mean radius of $0.202$ and certified proportion of $72.24$% at noise level $2.0$ (Table 2).\n\nSince the primary focus of this work is to introduce a novel DTW-based certified defense, we deliberately reported results at a fixed noise level (Table 1) rather than cherry-picking and tuning hyperparameters for each dataset. Table 2 further demonstrates that, with minor tuning, our method can achieve consistently high certified radii and proportions in most settings.\n\n\n**Concern in Weekness 3 & 6 \"Contribution and Difference with [14]\":** We agree with the first point in *Strengths* that our main contribution lies in providing a theorem for a more appropriate certified robustness metric, DTW, as formalized in Lemma 3.2 and Theorem 3.3 (Section 3.2). In contrast, the method in [14] applies exclusively to $l_p$-norm metrics.\n\nWhile we incorporate median smoothing from [14] as part of our anomaly score construction, the certification theorem we propose for DTW is non-trivial. It is the first in the literature to provide a certified guarantee in DTW distance. Importantly, a DTW radius generally encompasses more adversarial examples than an $l_p$-norm radius of the same size, meaning that our DTW certificate cannot be derived through a simple adaptation or trivial combination of existing $l_p$-norm results with DTW definition.\n\n**Concern in Weakness 3 \"no inf function\":** In applying median smoothing, we note that the $\\sup$ and $\\inf$ functions in [14] Definition 1 are equivalent for continuous distributions, as stated in [14] *“The inf and sup are equivalent for continuous distributions; the distinction is needed to handle edge cases with discrete distributions.”*\n\n**Concern in Weakness 4 & 5 \"Notation and Citations\":** We will add the corresponding citations and update the notation in the camera-ready version. \n\n**Concern in Limitation \"Experimental Validation Across Diverse Methods\":** We evaluated our method on three representative state-of-the-art (SOTA) anomaly detection models across eight widely used time-series anomaly detection datasets as reported in Section 4. The experimental setup is consistent with best practices in both the time-series anomaly detection [4][58][59] and certified robustness [18][55] communities.\n\nWe sincerely thank the reviewer again for your time and effort. We hope that our responses have clarified the issues raised and kindly request your consideration."}, {"review_id": "rBIreZRCkL", "reviewer": "Reviewer_JBUS", "summary": "Existing defenses for adversarial samples are either heuristic or only provide certified-robustness under l_p-norm. Time-series data has a unique characteristic where a small temporal shift may result in a much larger l_p-norm distance. This paper integrates DTW (dynamic time warping) similarity metric with l_p-norm guarantee, and proposes the first DTW-certified robust defense in time-series anomaly detection.", "questions": "How would an attack evolve to bypass this DTW-certified mechanism?\n\nIn general how big is the test-time overhead compared to baseline methods? Would it be a concern for adoption?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength:\n\nThis paper addresses a meaningful problem where the existing l_p-norm fails to preserve semantic meaning in temporal data, and is the first work to do so.\n\nTheoretical proofs are rigorous and solid.\n\nEvaluation results are comprehensive and demonstrate model-agnostic applicability.\n\nWeakness:\n\nAlthough computation overhead by monte carlo approach is mentioned as a known limitation, including a comparison on runtime would give a clue on how big this overhead can be.\n\nThe discussion of various attacks that may or may not bypass the proposed defense is also helpful for potential users to decide whether this is applicable to their system.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for the valuable feedback provided. Below, we clarify and address each concern in detail:\n\n**Computation overhead:** The Monte Carlo sampling introduces computational overhead, slowing inference by approximately a factor of $n$ (the number of noisy samples). The value of $n$ can be user-specified, where a larger $n$ gives a more precise estimation and usually a larger certified radius. \n\nWe would like to note that such overhead is intrinsic to all randomized smoothing methods [32][18][55], reflecting a fundamental trade-off for significantly stronger robustness guarantees. Nevertheless, randomized smoothing is still one of the most efficient and scalable approaches compared to other certified robustness methods [18].    \n\nOur method does not incur any additional cost beyond that of standard randomized smoothing, and reducing sample complexity remains an active research direction. In practice, the overhead can be substantially reduced through parallelization using multiple copies of the anomaly detector.\n\nWe provide additional results on running time overhead, evaluated in the settings as described in Section 4.\n* Normal inference: 1/498s per batch (size 64)\n* Inference and Certification: 1.83s per batch (size 64)\n\n\n**Attack to bypass this defence:** \nAs a certified defense method, we theoretically guarantee that no adversarial attack can bypass our approach as long as the adversarial example x' lies within the certified DTW radius e, i.e., DTW(x, x') < e (see Section 3.1, Threat Model and Certified Defense Goal). An attacker can only compromise the defense by introducing a perturbation exceeding the certified radius.\n\nWe sincerely thank the reviewer again for your time and effort. We hope that our responses have clarified the issues raised."}, {"review_id": "AdBfPMDEvc", "reviewer": "Reviewer_XuxL", "summary": "The paper proposes a novel DTW-certified robustness framework by adapting randomized smoothing approach. The proposed method bridges l-norm to DTW distances by a lower-bound transformation. Extensive experiments on various baselines and datasets are conducted to showcase the advantages of the proposed method.", "questions": "Q1. What’s the time cost of the proposed method? (W1)\nQ2. Can the proposed method scale to million-scale datasets? (W2)\nQ3. What are the impacts of different number of noisy samples and percentile p? (W3)", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths:\nS1. The paper provides a novel theoretical framework for bridging the l-norm and DTW-distances. \nS2. The paper proposes a robust and general defense mechanism that is model-agnostic. \nS3. The paper includes extensive experiments on various baselines and datasets. \nWeaknesses:\nW1. Lacks efficiency studies. No time cost analysis or empirical studies. \nW2. Lacks large scale datasets, i.e., million-scale. \nW3. Lacks more comprehensive hyperparameter studies, e.g. studies on number of noisy samples and percentile p. \nW4. Figure 1 could be improved with legends to indicates the adversarial changes.", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank the reviewer for the valuable feedback provided. Below, we clarify and address each concern in detail:\n\n**Q1** As shown in Figure 2, the DTW-based certification process uses an analytical solution that introduces no computational overhead. The observed slowdown arises from the Monte Carlo sampling step, which increases inference time roughly in proportion to the number of noisy samples $n$ (e.g., $n$=1000). The parameter $n$ is user-configurable: larger values yield more precise estimates and typically result in a larger certified radius.\n\nWe would like to note that such overhead is intrinsic to all randomized smoothing methods [32][18][55], reflecting a fundamental trade-off for significantly stronger robustness guarantees. Nevertheless, randomized smoothing is one of the most efficient and scalable approaches compared to other certified robustness methods [18]. Our method does not incur any additional cost beyond that of standard randomized smoothing, and reducing sample complexity remains an active research direction. In practice, the overhead can be substantially reduced through parallelization using multiple copies of the anomaly detector.\n\nWe provide additional results on running time overhead, evaluated in the settings as described in Section 4.\n* Normal inference: 1/498s per batch (size 64)\n* Inference and Certification: 1.83s per batch (size 64)\n\n**Q2** Our method does not require any modification to the training procedure and therefore imposes no computational overhead during training.\n\nFurthermore, we believe our approach can scale to million-scale testing datasets. As evidence, the SMD dataset evaluated in our experiments contains approximately $0.7$ million ($7 x 10^5$) testing timesteps with $25$ channels, and required $3:36:19$ (h:m:s) to complete both inference and certification. The computational overhead at testing time grows linearly with the dataset size, maintaining an inference time complexity of $O(n)$, equivalent to that of a standard model.\n\n**Q3** The impact of noisy samples is addressed in Q1. The percentile parameter $p$ has little impact on results as long as it reflects the majority distribution and is not overly influenced by outliers (i.e., extreme values $p = 0.0$ or $p = 1.0$). We will include a more comprehensive ablation study in the camera-ready version to further examine its effect.\n\nWe sincerely thank the reviewer again for your time and effort. We hope that our responses have clarified the issues raised."}]

Author rebuttal:

Meta-review: This paper introduces a DTW-based certified defense for time-series anomaly detection, offering a solid theoretical foundation and demonstrating model-agnostic applicability across diverse datasets. Its novelty and rigor make it a valuable contribution to the field. The main limitations concern the reliance on smoothness assumptions, computational overhead, and relatively limited evaluation scope, which constrain its demonstrated practicality. Nonetheless, all reviewers gave positive feedback, and the rebuttal effectively addressed most concerns. Overall, I recommend acceptance, with the expectation that the authors incorporate reviewer suggestions in the final version to strengthen clarity, efficiency analysis, and broader validation.
Decision: Accept (poster)