Title: Functional Virtual Adversarial Training for Semi-Supervised Time Series Classification
Venue: NeurIPS 2025
Accepted: yes
Keywords: Semi-Supervised classification; Virtual Adversarial Training; Function Space; Sobolev Space
Abstract: Real-world time series analysis, such as healthcare, autonomous driving, and solar energy, faces unique challenges arising from the scarcity of labeled data, highlighting the need for effective semi-supervised learning methods. While the Virtual Adversarial Training (VAT) method has shown promising performance in leveraging unlabeled data for smoother predictive distributions, straightforward extensions of VAT often fall short on time series tasks as they neglect the temporal structure of the data in the adversarial perturbation. In this paper, we propose the framework of functional Virtual Adversarial Training (f-VAT) that can incorporate the functional structure of the data into perturbations. By theoretically establishing a duality between the perturbation norm and the functional model sensitivity, we propose to use an appropriate Sobolev ($H^{-s}$) norm to generate structured functional adversarial perturbations for semi-supervised time series classification. Our proposed f-VAT method outperforms recent methods and achieves superior performance in extensive semi-supervised time series classification tasks (e.g., up to $ \approx 9$ % performance improvement). We also provide additional visualization studies to offer further insights into the superiority of f-VAT.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper points out that the Virtual Adversarial Training falls short on time series as the added perturbations bounded by  Euclidean norm disrupt time series patterns. The paper proposes the Sobolev norm to replace the Euclidean norm to generate structured functional adversarial perturbations.\n\nSTRENGTHS AND WEAKNESSES:\n### **Strengths**\n\nThis paper points out that the Virtual Adversarial Training falls short on time series: the perturbation vector constrained by Euclidean norm disrupts temporal patterns. This insight is very enlightening for designing effective adversarial methods tailored for time series.\n\n\n\n\n\n### **Weakness 1**\n\nWhy is time series considered functional data, while images are not? Time series is a function of some interval $T$, and images can also be considered functions in a spatial context. \n\nDespite \"Functional\" being a key term in the title, I still do not understand its specific meaning in this paper after reading the introduction. Additionally, it's unclear what unique designs are applied to time series (at least not sufficiently articulated in the introduction). From this perspective, I believe the writing of the paper needs improvement.\n\n### **Weakness 2**\n\nThe clarity and motivations in Section 3 are confusing.\n\n- **W 2.1**: How do Theorem 3.3 and Theorem 3.4 assist in the method design? The condition of Theorem 3.3  is that the model is linear, and the condition of  Theorem 3.4 is $\\epsilon\\rightarrow0^+$. **These two conditions are not satisfied in practical training**.\n- **W 2.2**: Based on Line 163~170, the conclusions of Theorem 3.3 and Theorem 3.4 state that \"if we want to impose a stronger norm on the sensitivity of the method, we should relax the norm of the perturbation.\" How is this related to the introduction of the Sobolev norm?\n- **W 2.3**: Why does the Sobolev space penalize high-frequency oscillations? Is the benefit of the Sobolev space solely that it penalizes high-frequency noise? This can be achieved through common high-frequency filtering, which has already been widely applied in existing time series analysis methods.\n- **W 2.4**: Compared with VAT: \n  - The VAT only needs a hyperparameter $\\epsilon$, but f-VAT needs **four hyperparameters** $\\epsilon$,  $s$, $L$, and $\\eta$. VAT only needs to compute once to obtain the optimal perturbation $r$, whereas f-VAT requires $L$ iterations and the hyperparameter $\\eta$. \n  - Do the perturbation vector $r$ and the model parameters $\\theta$ share the same learning rate $\\eta$ as shown in Algorithm 1?  \n  - In addition to the Sobolev norm order, the sensitive analysis of other hyperparameters should be included, along with a comparison of the training time between VAT and f-VAT.\n- **W 2.5**: In Line 6 of Algorithm 1, why adopt gradient ascent and normalize  $r_i$? In the original paper of VAT, the optimal $r$ is obtained by calculating the first dominant eigenvector of the Hessian matrix $\\nabla\\nabla_r D(r, x, \\hat{\\theta})|_{r=0}$. Is the approach not suitable for f-VAT? For instance, calculate the optimal $r$ whose Sobolev norm is $\\epsilon$ in the direction of the first dominant eigenvector? \n- **W 2.6**: Could the authors provide the formula of $||\\cdot|| _ {H ^ {-s}}$ as well, rather than just $||\\cdot|| _ {H ^ {s}}$. It is confusing that Eq 11 only introduces $||\\cdot|| _ {H ^ {s}}$, while Algorithm 1 actually constrains $r$ using $||\\cdot|| _ {H ^ {-s}}$. Additionally, in Eq 11 and its context, $L$ and $L _ N$ seem to be confused. \n\n### **Weakness 3**\n\nThis paper lacks a discussion of related works, particularly in the area of semi-supervised time series. Additionally, the experiments do not compare with the latest semi-supervised methods [1, 2]. More importantly, the paper only includes three datasets from UCR and three from UEA. However, TS-TFC [1] includes **106 datasets** from UCR. As far as I know, these time series datasets are relatively small-scale and highly heterogeneous, making the evaluation in the paper seem inadequate.\n\n[1] Temporal-Frequency Co-training for Time Series Semi-supervised Learning. *AAAI*, 2023.\n\n[2] Self-supervised Contrastive Representation Learning for Semi-supervised Time-Series Classification. TPAMI, 2022.\n\n\n\n### **Weakness 4**\n\nIn Section 4.3, the authors claim that functional adversarial perturbations add subtle disturbances only in non-critical areas, while keeping them small in important regions. However, I did not observe this phenomenon. **Where are the critical regions versus the non-critical regions?** It appears that f-VAT applies small perturbations at each time point, while VAT applies larger perturbations at certain time points.\n\nTherefore, a straightforward improvement to VAT could involve not only constraining the norm of the overall perturbation vector but also limiting the magnitude of perturbations at each time point, or constraining the variance of perturbations at each time point. Would this be viable？\n\nQUESTIONS:\nPlease refer to Weaknesses.\n\nLIMITATIONS:\nThe evaluation is limited and some statements are confusing.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the flaw of a famous semi-supervised learning method, VAT, when adopted in time series classification tasks, which is suggested to be caused by neglecting the temporal structure of the data in the adversarial perturbation. In response, the paper proposes functional-VAT (f-VAT), using an appropriate Sobolev norm to generate structured functional adversarial perturbations to incorporate the functional structure of the data into perturbations.\n\nSTRENGTHS AND WEAKNESSES:\n[Strengths]\n\n- Semi-supervised learning for time series classification is an important but highly under-explored topic. I believe it is meaningful to specifically consider the characteristics of time series data, just as this paper did.\n\n- Utilizing the duality between perturbation norm and gradient sensitivity and introducing the Sobolev norm to generate structured adversarial perturbations is reasonable to me. The theoretical derivation looks elegant and solid.\n\n- The experimental results look promising, showing clear improvement of the proposed method.\n\n\n[Weaknesses]\n\n- My biggest concern is that the motivation is not convincing enough. Specifically, I could understand that adopting VAT in time series classification tasks would face the suggested problem, inspiring the proposed improvement. However, in the first place, why is it necessary to use VAT? VAT is a quite classical method proposed several years ago, with various more advanced semi-supervised learning methods appearing subsequently. Does VAT have any particular advantages over them in time series tasks? From my perspective, building upon VAT is afraid to limit the contribution of the proposed method to the current real-world practices.\n\n- As UCR and UEA repositories include 100+ time series classification datasets, just using six datasets is not sufficient and representative for me. I would suggest either including the majority of the datasets or pre-setting a specific rule to select the experimental datasets to avoid cherry-picking. For the compared baseline methods, there is the same case. While it is argued that the settings of both datasets and baselines are the same as [17], please note that it is published on ICASSP. The experiment range that is solid enough for ICASSP may not be similarly solid enough for a top conference like NeurIPS.\n\n- There is a lack of empirical evidence for some minor points. For instance, while the paper provides a theoretical complexity for implementing the Sobolev norm, it would be beneficial to include an empirical comparison of the actual training overhead of f-VAT versus standard VAT. \n\n- The code is not available for reproduction.\n\n\n[Recommendation]\n\nOverall, the novelty, insights, and contributions of the paper are borderline for NeurIPS. The suggested method is quite interesting, and the current results seem promising. However, I have certain concerns about the motivation, and the experiments are not solid enough. Therefore, I recommend a borderline rejection at this time, and would like to change my score based on the rebuttal and the discussion with other reviewers later.\n\nQUESTIONS:\nPlease check the weaknesses.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

comments: SUMMARY:
This paper proposes a framework of functional Virtual Adversarial Training (f-VAT) for semi-supervised time series classification. The theoretical analysis and foundation are established for the proposed  algorithm. The experimental results demonatre its effectiveness.

STRENGTHS AND WEAKNESSES:
Strengths:
    This paper tries to utlize the Virtual Adversarial Training (VAT) method on leveraging the unlabeled data of semi-supervised time series classification for smoothing the predictive distributions and proposes the framework of functional Virtual Adversarial Training  (f-VAT) to incorporate the functional structure of the data into perturbations. It theoretically establishes a duality between the perturbation norm and the functional model sensitivity, and then use an appropriate Sobolev norm to generate structured functional adversarial perturbations for semi-supervised time series classification. The proposed algorithm is reasonable  and novel for  semi-supervised time series classification. The experiments  strongly support the theoretical  analysis.

Weeknesses: The description of theoretical results is not so logic or explainable. It is a big jump to make the derivation from the linear model to the continously differentiiable case. The authors should give a good explain for this generalization in the paper.

QUESTIONS:
Accoding to Eq.(11), the H^s norm can be only approximated, how about the approximation error here? Is there the other method to compute  the norm? How to select the proper s for a practical problem or task?

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-04

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes functional Virtual Adversarial Training (f-VAT), a novel method for semi-supervised time series classification. The key insight is that standard Virtual Adversarial Training (VAT), when applied to time series, uses Euclidean norm-bounded perturbations, which ignores the temporal structure of the data and leads to unrealistic \"jagged\" adversarial examples. To address this, f-VAT incorporates the structure of time series by constraining the adversarial perturbations using a Sobolev norm. Empirically, the authors demonstrate that f-VAT significantly outperforms standard VAT and other state-of-the-art methods on several semi-supervised and fully-supervised time series classification benchmarks.\n\nSTRENGTHS AND WEAKNESSES:\n##### Strengths\n- The paper introduces a novel and well-motivated approach, where the authors use functional analysis tools (Sobolev norms) to generate structured adversarial perturbations for time series data\n- The work is technically strong, where it provides a theoretical foundation for the proposed framework, establishing a duality between the perturbation norm and the model's sensitivity.\n- The empirical evaluation is comprehensive, where the proposed method is tested on six datasets, consistently showing significant performance improvements over multiple baselines, including standard VAT. The results hold across different ratios of labeled data and in a fully-supervised setting.\n- The paper is well-written. The qualitative analyses, including visualizations of perturbations and loss landscapes, provide good intuition and support the paper's claims.\n##### Weaknesses\n- The paper's empirical validation of the Sobolev order `s` is based on a single dataset (NATOPS), where `s=2` was found to be optimal. It is not entirely clear if this choice is universally optimal or if `s` is a sensitive hyperparameter that would require tuning for each new dataset. A brief discussion on the generalization of this choice would strengthen the paper.\n- While the paper mentions the efficacy of the norm computation (O(N log N)), I could not find an explicit comparison of the total training time between f-VAT and standard VAT. A discussion on the practical computational overhead would be a valuable addition.\n\nQUESTIONS:\n- Regarding the choice of the Sobolev order `s`, do the authors have any practical guidance on selecting `s` for a new task without performing an exhaustive search?\n- Could you elaborate on how one might design other norms for different types of time series? For instance, for data with known seasonality or periodic patterns, could a norm be designed in the Fourier domain to specifically encourage or penalize perturbations in certain frequency bands?\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations of their work in Section 5", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-12"}