Title: Fortifying Time Series: DTW-Certified Robust Anomaly Detection
Venue: NeurIPS 2025
Accepted: yes
Keywords: Certified Robustness

Anomaly Detection

Time Series
Abstract: Time-series anomaly detection is critical for ensuring safety in high-stakes applications, where robustness is a fundamental requirement rather than a mere performance metric. Addressing the vulnerability of these systems to adversarial manipulation is therefore essential. Existing defenses are largely heuristic or provide certified robustness only under $\ell_p$-norm constraints, which are incompatible with time-series data. In particular, $\ell_p$-norm fails to capture the intrinsic temporal structure in time series, causing small temporal distortions to significantly alter the $\ell_p$-norm measures. Instead, the similarity metric Dynamic Time Warping (DTW) is more suitable and widely adopted in the time-series domain, as DTW accounts for temporal alignment and remains robust to temporal variations. To date, however, there has been no certifiable robustness result in this metric that provides guarantees. In this work, we introduce the first DTW-certified robust defense in time-series anomaly detection by adapting the randomized smoothing paradigm. We develop this certificate by bridging the $\ell_p$-norm to DTW distance through a lower-bound transformation. Extensive experiments across various datasets and models validate the effectiveness and practicality of our theoretical approach. Results demonstrate significantly improved performance, e.g., up to 18.7\% in F1-score under DTW-based adversarial attacks compared to traditional certified models.


Peer reviews:
comments: SUMMARY:
The paper proposes a novel DTW-certified robustness framework by adapting randomized smoothing approach. The proposed method bridges l-norm to DTW distances by a lower-bound transformation. Extensive experiments on various baselines and datasets are conducted to showcase the advantages of the proposed method.

STRENGTHS AND WEAKNESSES:
Strengths:
S1. The paper provides a novel theoretical framework for bridging the l-norm and DTW-distances. 
S2. The paper proposes a robust and general defense mechanism that is model-agnostic. 
S3. The paper includes extensive experiments on various baselines and datasets. 
Weaknesses:
W1. Lacks efficiency studies. No time cost analysis or empirical studies. 
W2. Lacks large scale datasets, i.e., million-scale. 
W3. Lacks more comprehensive hyperparameter studies, e.g. studies on number of noisy samples and percentile p. 
W4. Figure 1 could be improved with legends to indicates the adversarial changes.

QUESTIONS:
Q1. What’s the time cost of the proposed method? (W1)
Q2. Can the proposed method scale to million-scale datasets? (W2)
Q3. What are the impacts of different number of noisy samples and percentile p? (W3)

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-06-30

comments: SUMMARY:
Existing defenses for adversarial samples are either heuristic or only provide certified-robustness under l_p-norm. Time-series data has a unique characteristic where a small temporal shift may result in a much larger l_p-norm distance. This paper integrates DTW (dynamic time warping) similarity metric with l_p-norm guarantee, and proposes the first DTW-certified robust defense in time-series anomaly detection.

STRENGTHS AND WEAKNESSES:
Strength:

This paper addresses a meaningful problem where the existing l_p-norm fails to preserve semantic meaning in temporal data, and is the first work to do so.

Theoretical proofs are rigorous and solid.

Evaluation results are comprehensive and demonstrate model-agnostic applicability.

Weakness:

Although computation overhead by monte carlo approach is mentioned as a known limitation, including a comparison on runtime would give a clue on how big this overhead can be.

The discussion of various attacks that may or may not bypass the proposed defense is also helpful for potential users to decide whether this is applicable to their system.

QUESTIONS:
How would an attack evolve to bypass this DTW-certified mechanism?

In general how big is the test-time overhead compared to baseline methods? Would it be a concern for adoption?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper aims to provide provable robustness for time series anomaly detection under Dynamic Time Warping (DTW) distance. The authors argue that existing Lp-norm based certification methods are unsuitable for time series data due to their sensitivity to temporal distortions. Building upon this observation, they propose a novel certification approach that bridges Lp-norm to DTW distance through randomized smoothing and lower-bound transformation. The proposed method is model-agnostic and has been experimentally validated across multiple datasets.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The research problem addressed in this paper is meaningful. Identifying more appropriate robustness metrics (e.g., DTW) for time series data compared to conventional Lp-norm measures represents a valuable research direction.\n2. The model-agnostic nature of the proposed methodology substantially enhances its potential applicability across diverse domains.\n3. The authors propose a novel certification approach that bridges Lp-norm to DTW distance through randomized smoothing and lower-bound transformation, supported by a strong theoretical framework.\n\nWeaknesses：\n1. Although the paper compares with Lp-norm certification, this comparison may not be entirely fair. The DTW attack itself is specifically designed to maximize DTW distance, so it's expected that Lp-norm certification would perform poorly under such attacks.\n2. The results (Table 1) show that on some data sets (such as SMAP, NIPS-TS-SWAN), the mean of the verifiable radius is very small (such as 0.037,0.022), and the certified proportion is not high. This shows that the actual protection ability of the method is very limited on these datasets. Although the explanation (high dimension and large data variance) of this paper is reasonable, it also exposes the vulnerability of the method. \n3. What is the difference between the smoothed anomaly score function and the median smoothing in [14]? Why only the sup function is used to represent this, but no inf function?\n4. A literature citation is required when Dynamic Time Warping first appears in the paper.\n5. X= RL×C should be change to XRL×C\n6. The contributions of abstact and introduction are weak. In the method part, this work simply combines random smoothing and DTW technology, and the contribution of the statement is not fully reflected in the method part. In the experimental part, the feasibility of the theory is not verified in more methods, and the performance improvement brought by the method is not uniform。\n\nQUESTIONS:\nSee my comments on the weakness.\n\nLIMITATIONS:\nWhile the paper introduces a theoretically sound DTW-based certification approach with broad applicability, several weaknesses limit its impact. The comparison with Lp-norm certification is arguably unfair, as DTW-specific attacks inherently favor DTW metrics. Practical effectiveness is questionable, with extremely small verifiable radii (e.g., 0.022) and low certified proportions on key datasets (SMAP, NIPS-TS-SWAN), revealing vulnerability to high-dimensional, high-variance data. The method’s novelty is unclear—it combines randomized smoothing and DTW without sufficiently differentiating from prior work (e.g., median smoothing in [14]) or justifying design choices (e.g., exclusive use of sup function). Presentation issues (missing citations, unclear notation) and weakly articulated contributions further undermine the work. Most critically, experiments lack validation across diverse methods, and performance gains are inconsistent, leaving the method’s added value unconvincing.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces the first certified‐robust defense for time-series anomaly detection measured in Dynamic Time Warping (DTW) distance. It adapts randomized smoothing to obtain an ℓ₂-norm certificate and then analytically translates this guarantee to DTW by exploiting the Keogh lower bound, yielding a closed-form certified radius that can be reported at inference time. Because the smoothing wrapper sits on top of any pre-trained detector, the method is model-agnostic and requires no retraining. Empirical tests on seven benchmark datasets and three modern detectors show that the approach maintains high detection accuracy while improving F1 scores against strong DTW adversaries, substantiating both its practicality and theoretical soundness.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n1. The paper closes a gap by deriving a formal certificate in Dynamic Time Warping (DTW) distance rather than the usual $l_p$ norms, which are known to mis-characterise temporal distortions. This is positioned as the first such result in this domain.\n\n2. Because the defense is applied post-training (it wraps a pre-trained detector with a smoothing/denoising layer), practitioners can add robustness onto existing systems without retraining.\n\n3. By proving Lemma 3.2 and Theorem 3.3, the authors map any $l_2$-certified radius obtained via randomized smoothing to an explicit DTW radius through the Keogh lower bound. This connection is practically computable.\n\n**Weaknesses**\n\n1. The paper's robustness guarantee quietly depends on the anomaly-score function changing smoothly whenever the input is nudged a tiny bit. The key lemma assumes that adding a small amount of Gaussian noise cannot reorder which inputs look more or less anomalous, something that holds only when the score has no sudden jumps. The three neural network detectors tested in the experiments behave this way, so the proof is valid for them. But any detector that uses hard thresholds, coarse rounding, or aggressive max-pool operations could let its score flip abruptly under minuscule input changes, breaking the guarantee. Therefore, the defense is provably safe only for detectors that produce smooth, gently varying scores, which narrows its general usefulness.\n\n2. The paper's promise that its method can be extended to any distance norm \"with minimal modification\" is not backed up by the proofs. Every step of the theoretical argument is built around ordinary Euclidean distance: the randomized-smoothing lemma protects the model only against perturbations measured in that specific way, and the later conversion from Euclidean radius to a Dynamic-Time-Warping radius depends on algebra and geometric facts that hold only under Euclidean geometry. The authors never supply a new noise-adding scheme, inequality, or optimization path that would make the same guarantee work for other norms, so the statement in lines 124-126 that such a change would be easy remains an unproven claim.\n\n3. Certified prediction relies on huge amounts of Monte-Carlo samples, adding tangible latency that could hinder real-time monitoring.\n\nQUESTIONS:\n1. Generality Beyond Euclidean Norms.\nThe paper states that the proposed certificate “readily generalizes to arbitrary norm orders p” (line 125). However, both the theoretical development and the experiments appear tailored to the Euclidean norm. Could the authors provide a concrete derivation for at least one non-Euclidean case (e.g., p=1) and report certified radii on the same datasets?\n\n2. Smoothness Assumption in Lemma 3.1.\nLemma 3.1 hinges on smooth anomaly scores, yet the manuscript does not explicitly state any regularity conditions on the anomaly score function $f$. I encourage the authors to formally state the smoothness or continuity assumptions required for the lemma to hold, and possibly include a brief proof sketch showing that the percentile smoothing preserves these properties.\n\n3. Inference Efficiency and Latency.\nThe proposed method relies on large numbers of Monte Carlo samples (e.g., $n = 1000$ in experiments), which may cause considerable inference latency. It would be helpful if the authors could include measurements of wall-clock latency or throughput, particularly for typical values of $n$.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-04"}