BackTime: Backdoor Attacks on Multivariate Time Series Forecasting

Authors: xiao  lin
zhining  liu
dongqi  fu
ruizhong  qiu
hanghang  tong
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-12 04:11:35

Abstract: Multivariate Time Series (MTS) forecasting is a fundamental task with numerous real-world applications, such as transportation, climate, and epidemiology. While a myriad of powerful deep learning models have been developed for this task, few works have explored the robustness of MTS forecasting models to malicious attacks, which is crucial for their trustworthy employment in high-stake scenarios. To address this gap, we dive deep into the backdoor attacks on MTS forecasting models and propose an effective attack method named BackTime. By subtly injecting a few \textit{stealthy triggers} into the MTS data, BackTime can alter the predictions of the forecasting model according to the attacker's intent. Specifically, BackTime first identifies vulnerable timestamps in the data for poisoning, and then adaptively synthesizes stealthy and effective triggers by solving a bi-level optimization problem with a GNN-based trigger generator. Extensive experiments across multiple datasets and state-of-the-art MTS forecasting models demonstrate the effectiveness, versatility, and stealthiness of BackTime attacks.

Main paper: 
 introduction: 
 Time series forecasting finds its applications across diverse domains such as climate [71, 42, 7, 32, 27] , epidemiology [17, 15, 66, 24] , transportation [63, 76, 45, 37] , and financial markets [61, 26, 72, 51] . Multivariate time series (MTS) represent a collection of time series with multiple variables, and MTS forecasting aims to predict future data for each variable based on their historical data and the complex inter-variable relationship among them. Due to its wide applications and complexity, it has become an important research area. The rapid advancement of deep learning [75, 73, 74, 33, 58, 6, 47] has significantly contributed to solving time series forecasting challenges. Many deep learning models have been developed to tackle this problem, including Transformer-based [80, 53, 68, 25] , GNN-based [31, 63, 29, 12, 11] and RNN-based [3, 34] models.Despite the remarkable capacity of deep learning models, there is an alarming concern that they are susceptible to backdoor attacks [64, 28, 79, 50, 46] . The attack involves the surreptitious injection of triggers into datasets, causing poisoned models to provide wrong predictions when the inputs contain malicious triggers. Extensive works have shown that backdoor attack poses a serious risk across various classification tasks, including time series classification [38, 18] . However, the threat to time series forecasting remains unexplored and is of great importance to be investigated. For example, data-driven traffic forecasting systems are used in multiple countries to control traffic light timing, e.g., Google's Project Green Light [1] . If the input signals to these forecasting systems are manipulated by hackers to provide malicious predictions, it could lead to widespread traffic congestion and thus brings negative economic and societal impacts. Similar situations, such as attacks to stock prediction [8, 61, 77] and climate forecasting [59, 60, 62, 30] , would significantly weaken the reliability of forecasting models and do great harm.To address this critical and imminent issue, we extend the application landscape of backdoor attack from MTS classification to forecasting. Unlike traditional backdoor attacks that focus on specific class labels, our approach aims to induce poisoned models to predict future data as a predefined target pattern. This new problem prompts several questions that deserve exploration in this paper: First, stealthy attack, i.e., to what extent can such a manipulation on datasets be imperceptible by minimizing the amplitude of triggers and maintaining a low injection rate [46, 22] ? Second, sparse attack, i.e., how can data manipulation be confined to a small subset of variables within MTS [48] ?In this paper, we present a novel generative framework for generating stealthy and sparse attacks on MTS forecasting. To begin with, we first describe a threat model that introduces attackers' abilities and goals, paving the way for formally defining the problem of MTS forecasting attacks. Then, to realize the conceptual attackers, we formalize the trigger generation within a bi-level optimization process and design an end-to-end generative framework called BACKTIME, which adaptively constructs a graph that measures inter-variable correlations and iteratively solves the bi-level optimization by employing a GNN-based trigger generator. The intuition behind this is that triggers effective for one variable are likely to be successful in attacking similar variables. During the optimization, generated triggers can be sparsely added to only a subset of variables, thereby only altering the model's prediction behavior for these target variables. Moreover, to ensure the stealthiness of the attack, we introduce a non-linear scaling function into the trigger generator to limit the amplitude of triggers and also leverage a shape-aware normalization loss to ensure that the frequency of the generated triggers closely match those of the normal time series data.In summary, our main contributions are as follows:• Problem. To the best of our knowledge, we are the first to extend the concept of backdoor attacks to MTS forecasting. We identify two crucial properties of backdor attacks on MTS forecasting: stealthiness and sparsity; and further devise a novel threat model on this basis. • Methodology. We propose a bi-level optimization framework for backdoor attacks on MTS forecasting, aiming to generate effective triggers under stealthy constraints. Based on this framework, we leverage a GNN-based trigger generator to design triggers based on the inter-variable correlations. • Evaluation. We conduct extensive experiments on five widely used MTS datasets, demonstrating that BACKTIME achieves state-of-the-art (SOTA) backdoor attack performance. Our results show that BACKTIME can effectively control the attacked model to give predictions according to the attacker's intent when faced with poisoned inputs, while maintaining its high forecasting ability for clean inputs.2 New Backdoor Attack Setting for MTS Forecasting 
preliminary: 
 Multivariate time series forecasting. In multivariate time series, the dataset encompasses time series with multiple variables, denoted as X = {x 1 , x 2 , . . . , x N } ∈ R T ×N where T represents the time spans, N represents the number of variables, and x i is the time series sequence of the i-th variable. For forecasting tasks, a widely used method for training is to slice time windows from the dataset as the training inputs. Let t IN denote the length of time windows. Then for any timestamp t i1 , the input will consist of historical sequences spanning from timestamps t i -t IN Backdoor Attacks on Classifications Traditional backdoor attacks have proven highly effective in classification tasks across diverse data formats. Given a dataset D = {X , Y} with X and Y representing the set of samples (e.g., images, text, time series) and corresponding labels, respectively, attackers generate some special and commonly invisible patterns, which are called triggers. For example, triggers could be specific pixels in images, [28, 64, 10] , particular sentences in text [43, 57, 13] , and designed perturbations on time series [38, 18] . These triggers are then inserted into a small subset of samples in D, with their labels flipped to a predefined target label. After training on the poisoned dataset, models will predict the class as the target label if the inputs contain triggers while still performing normally when facing clean inputs, i.e., the inputs without triggers.Compared with the traditional backdoor attack [10, 64, 28, 38, 18, 43, 57] , the backdoor attack on MTS forecasting bears several important and unique challenges, as shown in Table 1 .Considering tasks, traditional backdoor attack is applied for classification while this paper focuses on forecasting, which in turn brings the following four crucial differences. (1) Target object. Instead of flipping labels on classification, we concatenate triggers and target patterns into successive sequences and inject them together into the training set, thus building strong temporal correlations between triggers and target patterns. (2) Real-time attack. Unlike traditional backdoor attacks which may leverage ground truth data for trigger generation, the attack on forecasting is only allowed to use the historical data due to the timeliness. For example, if a hacker aims to alter the traffic flow data to reach a specific value at time t i , then this specific value should be determined before t i . Otherwise, the data manipulation will be too late and thus useless, since the traffic flow data would have already been sent to the forecasting system in real-time. It indicates that the shape of triggers at the timestamp of t i should be known ahead of t i . Therefore, the generation of triggers can only utilize data of t i -1 at most. Considering data, MTS data bears the following uniqueness.(1) Human unreadability. Analyzing time series data often requires specialized knowledge, like financial expertise for stock prices. This makes it harder for humans to detect modifications in time series data compared to images or texts. Hence, human judgments is not reliable for assessing the stealthiness of backdoor attack on forecasting. As a result, we leverage anomaly detection methods as the stealthiness indicator, since if a trigger is not stealthy, it will differ significantly from the original data, making it detectable as an anomaly.(2) Inter-variable dependence. Compared with univariate time series, the attack on MTS data are much more complicated due to the inter-variable correlations. Since advanced forecasting models [68, 81, 9, 31, 80] tend to leverage correlations between variables to enhance their forecasting performances, if a trigger can successfully attack the prediction of one variable, similar triggers might also work for closely correlated variables. Thus, trigger generation must consider both temporal dependencies and inter-variable correlations.Based on all these differences, we present the detailed treat model of backdoor attack on MTS forecasting as follows.Capability of attackers: Given a training dataset, the attacker can select α T timestamps to poison, denoted as T ATK . Then, for each timestamp t i ∈ T ATK , the attacker generates an invisible trigger g ∈ R t TGR ×|S| , where t TGR denotes the length of the trigger, and S ⊆ {1, . . . , N } denotes the selected variables to poison. After that, the attacker starts to poison the corresponding time series by injecting the trigger, i.e., X [t i -t TGR : t i , S] ← X [t i -t TGR -1, S] ⊕ g, and also replacing the future data with the target pattern, i.e., X [t i : t i + t PTN , S] ← X [t i -t TGR -1, S] ⊕ p, where ⊕ represents the addition with Python broadcasting mechanism, and t PTN is the length of a predefined target pattern.The data poisoning example is illustrated in Figure 1 .(1) Attacked forecasting models predict the future as the ground truth when facing clean inputs. (2) Attacked forecasting models predicts the future of the target variables as the given target pattern when the poisoned historical data contains triggers.Problem 1 Backdoor attacks on multivariate time series forecasting.Input: (1) a clean dataset X ∈ R T ×N where T represents the time span and N represents the number of variables; (2) a predefined target pattern p with a length of t PTN ; (3) the length t TGR of triggers to be added, (4) a temporal injection rate α T , and (5) a set of target variables S satisfying |S| N ≥ α S with α S being the spatial injection rate. Output: a poisoned dataset X ATK by poisoning α T timestamps such that the performances of attacked models will align with goals of attackers if models are trained on a poisoned dataset.Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: [Yes] Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.• The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
backdoor attacks on mts forecasting: 
 In this section, we introduce our comprehensive threat model proposed for backdoor attacks on MTS forecasting. First, we formalize the general objective of our threat model in Section 3.1. Then, we introduce how to instance this objective with our BACKTIME in Section 3.2.In this section, we propose two unique designs for backdoor attacks on MTS forecasting based on the key differences discussed in Section 2.2.Stealthiness constraints on triggers and target patterns. To uphold stealthiness in backdoor attacks, it is imperative to ensure that the poisoned data closely resembles the ground truth data [38, 46, 67] . However, as Section 2 shows, the insertion of triggers is intended to be applied on the unknown future. This design limitation makes it almost impossible to ensure the similarity between the poisoned data and the unknown future. To alleviate this issue, we consider the similarity between the poisoned data and the recent historical data as a pragmatic alternative, indicating that the amplitude of generated triggers should be controlled under a small budget. In addition, the same constraint is supposed to be utilized on target patterns since target patterns are also integrated into the training data. Mathematically, we use L ∞ norm for stealthiness constraints like [20, 19] . Therefore, the stealthiness constraints could be formally written as:∥g∥ ∞ ≤ ∆ TGR , ∥p∥ ∞ ≤ ∆ PTN (1)where ∆ TGR and ∆ PTN are the budgets for triggers and target patterns, respectively.Soft identification on poisoned samples. In Multivariate Time Series (MTS) forecasting, a common practice [68, 35, 81, 9] involves slicing datasets into time windows to serve as inputs for forecasting models. However, in a poisoned dataset X ATK , identifying whether these sliced time windows are poisoned poses significant challenges for two primary reasons. First, the length of these time windows may not align with the length of triggers or target patterns. Second, when slicing datasets into time windows, these windows may encompass only a fraction of the triggers or target patterns. To solve these problems, we propose a soft identification mechanism. Specifically, we assume that the injected backdoor is activated only when inputs encompass all components of the triggers. Furthermore, we define the degree of poisoning in inputs based on the proportion of target patterns within the future to be forecasted. The rationale behind is that when the backdoor begins to be activated, its influence should be most pronounced, resulting in a significant impact on the forecasting process. As time goes, the strength of this effect gradually diminishes since the proportion of target patterns within the future decreases. Mathematically, for any timestamp t i , the soft identification mechanism is formalized as follows:EQUATIONwhere β(t i ) represents the soft identification mechanism at the timestamp t i , c TGR ti and c PTN ti are the length of triggers within X ATK ti,h and target patterns within X ATK ti,f , respectively. η is a monotonically decreasing function satisfying η(1) = 1 and η(0) = 0, which measures the significance attributed to the degree of poisoning. For example, if η rapidly decreases within the range of (0, 1), it implies that once the triggers are activated, the expected effects of triggers will diminish rapidly over time.To sum up, we refine the basic optimization problem [19, 20] of typical backdoor attack by integrating the above adjustments, hence providing a general mathematical framework for backdoor attack on MTS forecasting:EQUATIONwhere X ATK represents the poisoned dataset, T represents the set of timestamps in X ATK , f (•) denotes the forecasting model with its parameters of θ, L CLN is the clean loss for forecasting tasks, and L ATK is the attack loss designed to make the model's output resemble the target pattern. The key idea here is that, after a model is trained on the poisoned dataset X ATK through the lower-level optimization, we aim to minimize the expectation of difference between the output of this model and the target pattern, as shown in the upper-level optimization. This is based on the fact that in the upper optimization, X ATK ti,f contains at least a part of the target pattern g when β(t i ) ̸ = 0. Additionally, although constraints are imposed on both the triggers and the target pattern, the constraint on the target pattern does not actively participate in the optimization process. Instead, it serves as a constraint that the attacker is expected to adhere to when determining the shape of the target pattern.To successfully achieve backdoor attack on MTS forecasting, we need to determine three key elements: (RQ1) where to attack, i.e., identifying which variable to target; (RQ2) when to attack, i.e., selecting which timestamps to attack; and (RQ3) how to attack, i.e., specifying the trigger to inject. Regarding (RQ1) where to attack, as outlined in Problem 1, the target variables are determined by the attacker and can be any variable desired. Subsequently, we will discuss (RQ2) when to attack in Section 3.2.1, and provide the details of (RQ3) how to attack in Sections 3.2.2 and 3.2.3.In this section, we design an illustrative experiment to investigate the properties of the timestamps that are more susceptible to attack. The main idea of the experiment is, given a simple and weak backdoor attack, to observe the change of attack effect when choosing timestamps with different properties for attack. Based on the experiment results, we find that timestamps w.r.t. high prediction errors for a clean model are more susceptible to attacks.We investigate the properties of timestamps on the PEMS03 dataset. Specifically, we first train a forecasting model (i.e., clean model f CLN ) on the original dataset X and record the Mean Absolute Error (MAE) of the predictions for each timestamp. A higher MAE indicates poorer prediction performance for that timestamp. We then sort the timestamps in ascending order based on their MAE and divide them into ten groups, with average MAE percentiles of 0.05, 0.15, • • • , 0.95, as shown on the x-axis of Figure 2 . Then, for each group, we implement a simple backdoor attack, where a shape-fixed trigger and target pattern are injected to all the timestamps and variables within the timestamp group, and train a new model (i.e., attacked model f ATK ) on the poisoned data X ATK . The shapes of the trigger and the target pattern are shown in Appendix D. Intuitively, a timestamp t i that is susceptible to backdoor attack will have a low poisoned MAE, i.e., MAE(f ATK , X ATK ti,h , X ATK ti,f ). It means that at timestamp t i , the predictions of the attacked model can be greatly altered by the attack to fit the target pattern. However, relying solely on poisoned MAE is insufficient because if the target pattern closely resembles the ground truth, the poisoned MAE will still be low even if the attack fails. To address this problem, we test a clean model on the poisoned dataset and further record its clean MAE for each poisoned timestamp t i , i.e., MAE(f CLN , X ATK ti,h , X ATK ti,f ). Then, a lower MAE difference between poisoned MAE and clean MAE can reliably indicate more vulnerable timestamps, since the clean MAE will be quite low, leading to a high MAE difference, when the target pattern is similar to the ground truth. The experiment results, as shown in Figure 2 , demonstrate that the group with higher MAE percentile can continuously lead to a lower MAE difference. These findings imply that timestamps where a clean model performs poorly are more susceptible to backdoor attacks. Therefore, to ensure the strength of backdoor attack, for each timestamp t i , we leverage a pretrained clean model to calculate MAE between predictions and the ground truth X ti,f , and further select the top α T timestamps with the highest MAE, denoted as T ATK .Once the poisoned timestamps are determined, the next step is to generate adaptive triggers to poison the dataset. First, we generate a weighted graph by leveraging an MLP to capture the inter-variable correlation within the target variables S. Then, we further utilize a Graph Convolutional Network (GCN) [40] for trigger generation based on the learned weighted graph.Graph structure generation. Since we aim to activate backdoor in any timestamps, we do not expect that the generated graph is closely related to specific local temporal properties in the training set. Thus, we focus on building a static graph by learning the global temporal features within the target variables S. Motivated by this goal, we take as the entire input time series data x i , i ∈ S instead of using sliced time windows. However, the time span T of time series data is often very large, and hence it is inefficient to directly use total data without preprocessing. Therefore, we apply the discrete Fourier transform (DFT) [54] to effectively reduce the dimension while maintaining useful information. Intuitively, long-time-scale features, such as trends and periodicity, play a pivotal role in the global temporal correlation among variables, compared with the local noise or high-frequency fluctuations. Consequently, after DFT, we retain only the low-frequency features of the time series data. Mathematically, for any target variable i ∈ S, this transform could be expressed as z i = Filter(DFT(x i ), k) where DFT(•) represents the DFT transformation, and Filter(•, k) represents preserving the top k low-frequency features. Furthermore, we employ Multilayer Perceptron (MLP) to adaptively learn features of different frequencies. Subsequently, we utilize the output of the MLP to construct a graph that measures the correlation between target variables. The aforementioned process can be expressed as:EQUATIONwhere A i,j represents the element of learned graph A at the i-th row and the j-th column, and cos(•, •) represents the cosine similarity.Adaptive trigger generation. Once a correlation graph has been obtained, our objective shifts to the generation of learnable triggers that can be seamlessly integrated into various models with efficacy and imperceptibility. To ensure semantic consistency between triggers and historical data, we employ a time window with a length of t BEF to slice the historical data preceding the trigger. Then, we utilize a GCN for trigger generation based on the sliced historical data:EQUATIONIn experiments, we find the following phenomenon: the GCN intends to aggressively increase the amplitude of output ĝti . Even if an extra penalty on the amplitude is introduced, it still requires much effort to adjust the hyperparameters to control the trigger amplitude. One potential explanation for this behavior is that a large trigger amplitude leads to substantial deviation, and data points characterized by such deviations are more readily learned by forecasting models although they violate the requirements of stealthiness. To address this issue, we propose to introduce a non-linear scaling function, tanh(•), to generate stealthy triggers by imposing mandatory limitations on the amplitude of outputs ĝti . Mathematically, the generated triggers can be formalized as follows:g ti = ∆ TGR • tanh(ĝ ti ), ∀t i ∈ T ATK (6)After introducing the model architecture of the adaptive trigger generator f g in Eqs. ( 5) and ( 6), we aim to optimize the trigger generator through a bi-level optimization problem in Eq. ( 3) to ensure the effectiveness of the generated triggers. Recognizing the inherent complexity of bi-level optimization, we introduce a surrogate forecasting model f s to provide a practical approximation of the precise solution. This allows us to solve Eq. ( 3) by iteratively updating the surrogate model and the trigger generator. However, we further find that if we randomly initialize the surrogate model f s , then the performance of the trigger generator tends to fluctuates in the initial stage, posing a significant difficulty in convergence. Therefore, we introduce an additional warm-up phase. 8), ( 9) and (10); 9 Update g ti w.r.t. Eq. ( 6) and get X ATK ; 10 return X ATK ; At the first stage, we poison the clean dataset, as mentioned in Section 2.3. Then we aim to improve the forecasting ability of the surrogate model f s on the poisoned dataset X ATK . Specifically, we employ a natural forecasting loss function, denoted as L CLN , to update the surrogate model f s while fixing the parameters of the trigger generator f g :EQUATIONIn this paper, we use smooth L 1 loss [36] as the forecasting loss L CLN .As for the second stage, we aim to update the trigger generator f g for effective and unnoticeable triggers. Following Section 2.3, for each poisoned timestamp t i ∈ T ATK , we will utilize the trigger generator f g to obtain the trigger g ti based on Eqs ( 5) and ( 6), and then re-inject those triggers to obtain the poisoned dataset X ATK . The main difference of trigger injection between this stage and the first stage is that the gradient∂X ATK ∂gt ihere would be preserved. Then, we aim to implement the attack loss in Eq. ( 3) to ensure the effectiveness of triggers. Specifically, after fixing the parameter of the surrogate model f s , the attack loss could be formalized as:EQUATIONIn the paper, we set η(x) = x for simplicity, and set L ATK as the MSE loss.Furthermore, we introduce a normalization loss to regulate the shape of triggers, thereby enhancing their stealthiness. The main intuition is that high-frequency fluctuations or noises widely exist in MTS data of real-world datasets [35] , but the bi-level optimization in Eq. ( 3) does not inherently guarantee that triggers will have high-frequency signals. Therefore, to bridge this gap, the following normalization loss is introduced:EQUATIONwhere AVG(•) represents the average operation. The key idea is that triggers will exhibit alternating positive and negative components, i.e., fluctuations, if the summation of triggers along the temporal dimension approaches zero. To sum up, the loss function for the trigger generator in the second stage can be expressed as: l tgr = l atk + λ l norm , ∀t ∈ T ATK (10) where λ is a hyperparameter. All the above training procedures are summarized in Algorithm 1. Datasets. We conduct experiments on five real-world datasets, including PEMS03 [63] , PEMS04 [63] , PEMS08 [63] , weather [2] and ETTm1 [80] . The detailed information of these datasets are provided in Appendix B. For each dataset, we use the same 60%/20%/20% splits for train/validation/test sets.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [NA] Justification: [NA] Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
experiments: 
 Experiment protocal. For the basic setting of backdoor attacks, we adopt t TGR = 4 and t PTN = 7, with α T of 0.03 and α S of 0. Stealthiness evaluation. To verify that the data modifications of BACKTIME are imperceptible, we employ anomaly detection methods, GDN [16] and USAD [4] , to identify the poisoned time slots. Specifically, for each dataset, we train anomaly detection methods on the clean test set and then record the F1-score and the Area under the ROC Curve (ROC-AUC) on the poisoned training set. The experimental results are presented in Table 4 . The results show that, across all datasets, ROC-AUC is around 0.5 and F1-score is either around 0.5 or near 0, suggesting that the detection results are nearly close to that of random guess. These strongly demonstrates the stealthiness of BACKTIME.Ablation study. To investigate the impact of injection rates on the attack effectiveness, we conduct experiments on the PEMS03 dataset, with different temporal and spatial injection rates. The experimental results are shown in Figure 3 . Based on the results, as the temporal injection rate α T increases, a decreasing MAE A and RMSE A imply that the effect of BACKTIME gradually improves. However, even when α T = 0.015, BACKTIME still implements an effective attack. On the other hand, as the spatial injection rate α S increases, the effect of BACKTIME first improves and then decreases. This phenomenon may be due to the combined effects of two factors. First, an increase in α S leads to more poisoned data, which reduces the difficulty of backdoor attack. Second, an increase in α S leads to an increasing number of target variables, making the correlations among target variables more complicated and harder to learn. It increases the attack difficulty. Nonetheless, under all injection rates shown in Figure 3 , BACKTIME successfully achieves the attack, demonstrating its superiority. Backdoor attacks. Existing backdoor attacks aim to optimize triggers for effectiveness and stealthiness. Extensive works focus on designing special triggers, such as a single pixel [64] , a black-andwhite checkerboard [28] , mixed backgrounds [10] , natural reflections [50] , invisible noise [46] , and adversarial patterns [79, 67] . On time series classification, TimeTrojon [18] employs random noise as static triggers and adversarial perturbations as dynamic triggers, demonstrating that both types of triggers can successfully execute backdoor attacks. Jiang et al. [38] generate triggers that are as realistic as real-time series patterns for stealthy and effective attack.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: We provide the detailed setting as well as the hyperparameters in the Experiment section Guidelines:• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. , with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 
future directions and potential defenses: 
 Backdoor attacks on Multivariate Time Series (MTS) represent a novel area of research, presenting numerous promising avenues for both attack and defense. In terms of attacks, beyond pursuing stealthier and more efficient triggers, there are several intriguing challenges that BACKTIME does not address.First, attacking MTS imputation tasks remains unexplored and is difficult for BACKTIME to tackle.To achieve an effective backdoor attack, BACKTIME concatenates the trigger and target pattern sequentially to establish a strong temporal association, which is the foundation of its attack effectiveness. However, in time series imputation tasks, deep learning models infer missing values based on both preceding and subsequent data. This dual-direction inference reduces reliance on the data preceding the missing values, thus breaking BACKTIME's core assumption. Therefore, designing triggers that can influence both future and past data could be an interesting direction to explore.Second, backdoor attacks on MTS forecasting with missing values pose a significant challenge. BACKTIME's attack depends on the inclusion of a complete trigger in the input to predict the target pattern. If the trigger is incomplete due to missing values, the attacked model might fail to recognize the trigger, rendering the backdoor attack ineffective. Hence, it would be highly interesting to design triggers that remain effective even when only partial triggers are included.In terms of backdoor defense, detecting triggers in MTS is an intriguing problem and we provide some potential solutions here. First, there may be a frequency difference between the generated triggers and the real data. Therefore, detecting distribution shifts in the frequency domain could be a promising approach. Additionally, the generated triggers may lack the diversity present in real-world data. As a result, in the feature space, the (trigger, target pattern) pairs might cluster closely together, making it feasible to detect backdoor attacks using clustering algorithms. 
conclusion: 
 In system has more than 39,000 detectors deployed on the highway in the major metropolitan areas in California. There are three kinds of traffic measurements contained in the raw data, including traffic flow, average speed, and average occupancy.• Weather dataset. This dataset contains local climatological data for nearly 1,600 U.S. locations, 4 years from 2010 to 2013, where data points are collected every 1 hour. Each data point consists of the target value "wet bulb" and 11 climate features.• ETTm1 dataset. The ETT is a crucial indicator in the electric power long-term deployment.We collected 2-year data from two separated counties in China. The ETTm1 data is collected for 15-minute-level. Each data point consists of the target value "oil temperature" and 6 power load features. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [NA] Justification: Our work has no series societal impact.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [Yes]Justification: [Yes] Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: We provide the links for all the assets we use. Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA] Justification: [NA] Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: To validate that BACKTIME is model-agnostic, we train three state-of-the-art forecasting models, including TimesNet [68] , FEDformer [81] , and Autoformer [9] , on poisoned datasets. In the experiment, for each forecasting model, we use the default hyperparameter settings in the released code of corresponding publications3 . We use Adam optimizer with a learning rate of 0.0002 to update these models. These models serve as benchmarks for evaluating the effectiveness and versatility of BACKTIME across different model architectures. More details of these models are provided as follows.• TimesNet [68] . This model discovers the multi-periodicity adaptively and extract the complex temporal variations from transformed 2D tensors by a parameter-efficient inception block.• FEDformer [81] . This model utilizes Fourier transform to develop a frequency enhanced Transformer, aiming to enhance the performance and efficiency of Transformer for long-term prediction.• Autoformer [9] . By employing Auto-Correlation mechanism based on the series periodicity, this model conducts the dependencies discovery and representation aggregation at the sub-series level, demonstrating progressive decomposition capacities for complex time series.We utilize FEDformer [81] as the surrogate forecasting model for trigger generation. Concerning BACKTIME, we adopt t TGR = 4, t PTN = 7 and t BEF = 6, with the temporal injection rate α T being 0.03 and the spatial injection rate α S being 0.3. We further set k = 200, ∆ TGR = 0.2std and ∆ PTN = 0.4std for each dataset where std represents the standard deviation of the training set. Moreover, we set λ = 2, 000 for PEMS03, PEMS04, PEMS08, and Weather datasets, while λ = 5 for ETTm1 dataset. We use 2-layer MLP with the hidden layer of 64 for graph structure generation in Eq. 4 and use 2-layer GCN with the hidden layer of 64 as the backbone of our trigger generator.We compare BACKTIME with clean training strategy and three different trigger generation methods.• Clean. Models will not be attacked and will be trained on clean datasets.• Random. Timestamps for attack are randomly selected, and the trigger is generated from a uniform distribution ranging from -∆ TGR to ∆ TGR . This trigger is repeatedly used at each selected timestamp.• Inverse. This attack method flips the dataset along the temporal dimension and further trains a "forecasting" model that forecasts the history based on future data. By using the target pattern as input, the outputs of the prediction model are chosen as the trigger. In experiments, FEDformer [81] is used as the forecasting model. Please note that, for this attack method, the amplitude of generated triggers may exceed the trigger constraints, i.e., ∆ TGR . • Manhattan. This attack method locates time segments in the training set with the smallest Manhattan distance to the target pattern and uses the preceding time series data of those segments as triggers. Please note that, for this attack method, the amplitude of generated triggers may exceed the trigger constraints, i.e., ∆ TGR .Table 7 : The value of triggers on the timestamp selection experiment. In Section 3.2.1, we implement a simple and weak backdoor attack for identifying the properties of timestamps that are more vulnerable to attack. As for the setting of this backdoor attack, we use a shape-fixed trigger, whose data are listed in Table 7 , and a cone-shaped target pattern, whose data are shown in Figure 4 . For each timestamp group, we will inject this trigger and target pattern into every timestamp within the group, thus poisoning 10% timestamps in the training set. The experimental results show that timestamps where a clean model performs poorly are more susceptible to backdoor attacks.In Section 4, we validate the effectiveness of BACKTIME on three different shapes of the target patterns. These target patterns will be inserted into datasets with data standardization, and the specific shapes of the three target patterns are shown in Figure 4 . The endpoints of the three target patterns are equal to, higher than, or lower than their starting points, respectively. Intuitively, flipping the target patterns vertically should yield similar effects. Therefore, this paper focuses on target patterns that exhibit an upward trend after the starting point. Under these three target patterns, this paper demonstrates that BackTime can effectively attack various target patterns in MTS forecasting.The full results for BACKTIME and baselines with the cone-shaped target pattern are provided in Table 8 . From the results, we can observe that BACKTIME can continuously decrease MAE A to a low degree under any model architecture and any dataset. On PEMS03, PEMS04, and Weather datasets, BACKTIME surpass all the attack baselines, achieving the lowest MAE A across all the model architectures. It strongly demonstrates the effectiveness and versatility of BACKTIME. Justification: We clarify that scope of our method in both Abstract and Introduction, and also provide detailed contributions in Introduction.Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.38th Conference on Neural Information Processing Systems (NeurIPS 2024).For simplicity, in this paper we assume all timestamps ti satisfy t IN ≤ ti ≤ T -t OUT .We use seq[i : j] to denote a slice of seq that contains its elements with index from i to j -1.https://github.com/thuml/Time-Series-Library 


Decision: This paper proposes a backdoor attack method on multivariate time series forecasting task. It uses MAE to identify attack susceptible time frame, and then use GCN to generate an adaptive trigger. The method is trained with a bi-level optimization. Reviewers agree that the problem and the solution are novel, and the validation is sufficient.

Reviews: review: paper_summary: paper_summary: This paper primarily discusses how to conduct a backdoor attack on the multivariate time series forecasting task, proposing a two-stage training approach. The core idea is to identify timestamps with significant differences in MAE of the Clean model and Poisoned model on poisoned data points. Simultaneously, the trigger generation function is learned by minimizing the MAE loss of the model's prediction of the target pattern with triggers as input.
strength_weakness: strength_weakness: 1. The baseline methods in the paper are heuristic, and the worse MAE of these methods compared to the proposed method in the paper does not effectively illustrate the issue.
2. The types of anomalies illustrated in the paper are relatively simple.
questions: questions: 1. In Equation 3, according to the paragraph from lines 189-190, the clean loss should be the MAE using the clean samples to predict the ground truth, and the attack loss should be the MAE using the poisoned samples to predict the target pattern, right? However, in Equation 3, both MAE losses target $X^{ATK}_{ti,f}$. Here, clarification from the author is requested.
2. The training of the trigger generation network depends on initially manually generating some attack samples. Does the quality of these initial samples significantly affect the following training process? 
3. The two-stage training is very unstable, which the author mentioned in the paper, but there is no detailed description in the text. It would be helpful to understand the rationality of the model design if the author could provide the training loss change curve.
limitations: limitations: The author has discussed in the paper how to prevent the injected data points from having too large a magnitude and how to address training instability issues.
paper_summary: paper_summary: This paper proposed a backdoor attach method for multivariate time series forecasting, where only a few works focus on this topic. The injected stealthy triggers are interesting and effective in destroying raw data.
strength_weakness: strength_weakness: 1. The Trigger Generation and Bi-level Optimization are not clearly presented. Please extend the description of trigger generation and effectiveness.
2. The experiments need to be expanded, and the advantages of the proposed method are not well validated. 
3. Numerically, the authors could consider comparing their method with more baselines. There are some studies on backdoor attacks for forecasting models.
questions: questions: 1. The Trigger Generation and Bi-level Optimization are not clearly presented. Please extend the description of trigger generation and effectiveness.
2. The experiments need to be expanded, and the advantages of the proposed method are not well validated. 
3. Numerically, the authors could consider comparing their method with more baselines. There are some studies on backdoor attacks for forecasting models.
limitations: limitations: 1. What is the technical drawback of the proposed method? E.g., attack efficiency and hidden effect.
2. Are there any initial ideas to be able to look forward from a defense perspective?
paper_summary: paper_summary: The paper titled "BACKTIME: Backdoor Attacks on Multivariate Time Series Forecasting" introduces a novel method called BACKTIME, aimed at exploring the robustness of multivariate time series (MTS) forecasting models against backdoor attacks. BACKTIME enables an attacker to subtly manipulate predictions by injecting stealthy triggers into the MTS data. Through a bi-level optimization process using a graph neural network (GNN)-based trigger generator, the method identifies vulnerable timestamps and crafts effective, covert triggers. Comprehensive experiments across various datasets and cutting-edge MTS forecasting models demonstrate the efficacy, flexibility, and stealth of BACKTIME attacks.
strength_weakness: strength_weakness: - The paper does not adequately address potential limitations or discuss the robustness of the method against countermeasures. A more detailed analysis of the limitations and how they might affect the practical applicability of BACKTIME would strengthen the paper.
- The potential negative societal impacts of such attacks are not sufficiently explored. Given the sensitive nature of MTS forecasting in areas like climate, epidemiology, and finance, a deeper discussion on the broader implications is warranted.
questions: questions: - What are the potential limitations of the proposed method, especially regarding its generalizability to other types of time series data or forecasting models?
limitations: limitations: - The authors have not adequately addressed the limitations of their work, nor have they discussed the potential negative societal impacts of BACKTIME.

Comments: title: Response to Reviewer Bpy4
Response to Reviewer PmgC
Response to Reviewer mt9q
comment: We want to express our sincere thanks for your recognition of our work. Answering your insightful comments helps us improve the quality of our work. In the revised version of our paper, we promise to include discussions on potential defenses and broader implications. We are confident that these additions will enrich our contribution and provide a more comprehensive understanding of the impact and context of our work.
We sincerely thank you for your appreciation of our work. Your comments have been invaluable in guiding us in improving the quality of our research. In the revised version of the paper, we promise to include detailed descriptions of the trigger generation and bi-level optimization processes, as requested. Additionally, we will incorporate a discussion of potential defenses against the proposed attack. We believe that these enhancements will significantly strengthen our work and provide a more comprehensive understanding of its contributions.
Thank you for the detailed rebuttal. The clarification of BACKTIME's limitations and the discussion on societal impacts are appreciated. Addressing these aspects will indeed strengthen the paper. Please ensure these points are integrated into the manuscript for the next review. Continue to consider potential defenses and broader implications for various applications. My concern has been addressed. I will raise my score to accept.
Thanks for the authors' efforts in the detailed response. My concern has been addressed. I will raise my score to strong accept.
We are very glad to know that your concerns about the clean loss and trigger generation have been addressed. We also want to thank you for the follow-up questions and are happy to share more answers.

First, we would like to point out that standard backdoor attacks belong to the category of **data-poisoning** attacks, where modifications/augmentations to training data are a necessary and indispensable requirement in backdoor attacks across various domains [1,2,3,4], such that the attacked model learn the strong association between triggers and target pattern (or target class) in the training data, thereby altering its predictive behavior. Unlike traditional attacks that might rely solely on exposed data and could be short-sighted or ineffective, backdoor attacks strategically manipulate the training data to embed malicious behavior, which remains dormant during normal operations but can be triggered under specific conditions. This approach ensures that the attack is both stealthy and persistent.

Furthermore, under this data-poisoning setting, backdoor attacks can be highly threatening because neural network training requires a large amount of data, which is difficult to accomplish by only using private data. Therefore, by stealthily poisoning public datasets, attackers can pose a great threat to neural networks' wide application.

For example, in the healthcare field, it is hard for a single hospital to collect enough data to train a robust model. Hence, hospitals are likely to delegate to AI-related agencies, and those agencies mix the hospital-provided data with large-scale public data (e.g., scraped from the internet) to enhance model performance. By poisoning widely used public datasets, such as ERP [5] and OpenNeuro [6] datasets, backdoor attacks could pose a significant threat to the medical control systems used by hospitals.

The suggestion of a training-free strategy is quite interesting but indeed presents significant challenges to attack efficiency based on the current developments in the research community. Since a training-free backdoor attack, neither has any knowledge of the architecture of models to be trained nor has access to the data during training, the trigger can only be manually set. However, time series data varies greatly in both frequency and amplitude, ranging from traffic data to weather patterns. It is exceedingly difficult for a manually designed trigger to perform an effective attack across different time series datasets. Considering this, we believe that developing a training-free backdoor attack is a highly challenging research problem, and we would be very interested in exploring this in future research. 

[1] Badnets: Identifying vulnerabilities in the machine learning model supply chain.

[2] Backdoor attack with imperceptible input and latent modification

[3] Textual backdoor attack for the text classification system.

[4] A backdoor attack against lstm-based text classification systems.

[5] https://erpinfo.org/erp-core

[6] https://openneuro.org/
Thank the author for the reply. The explanation regarding clean loss and trigger generation has addressed my concerns. However, the examples in response to reviewer Bpy4 has not convinced me. In both the medical and stock market, the attacks are still conducted after data collection. If one can access the data in such private system, the most effective method would be to directly tamper with the data rather than using the indirect approach of constructing toxic samples to influence the model. The current method in the paper requires training to determine what kind of attack samples to generate, which I believe is a limited contribution. I am more looking forward to seeing attack methods and defense methods that are training-free. In total, I think this paper has not yet reached the level of a score 7 (clear accept), and I maintain my current score of 6 as weak accept."