Adversarially Robust Change Point Detection

Abstract: Mengchu Li, Yi Yu

Reviews and author responses:

This paper presents a method that aims for *robust* detection change points in a time series in the presence of noise, against the following adversarial attacks: (i) hiding true change points; (ii) creating spurious change points; and (iii) increasing the localisation error rate.  The key approach is to formulating the change point detection framework with the dynamic Huber epsilon-contamination model, such that the method can be robust against outliers and/or heavy-tail noise, as well as handling data that not out of the i.i.d. territory (e.g., temporally changing).
  Strengths:

The paper is well-written and well-organized, without obvious typos.

The topic is fundamental and useful for machine learning.

Allowing non-iid data distribution in change-point detection is the key contribution.

=======================================================

Major concerns:

(1) Section 1.1 should discuss why the proposed method is not a straightforward adaptation of the existing Huber epsilon-contamination model.

(2) The last paragraph in Section 3.1 claims that "the computational complexity of ARC is ... still more efficient than the existing methods"  There should be an experiment on time performance to show actual "timing" statistics as compared with the existing methods for different data set size.

(3) Section 4.1 gives some guidance on how to set h but h depends on C, which ranges 10 to 40. Are the results sensitive to h?  Also for real data, the paper suggests to use a range of smaller h.  Why smaller h for real data?  Also, how small is small?  If we use different values for h on the same data, how will the change point vary?  There should be an experiment of the sensitivity of the results to h.

(4) Missing several related references:
[R1] Selective review of offline change point detection methods, Signal Processing 2020
[R2] Doubly Robust Bayesian Inference for Non-Stationary Streaming Data with ß-Divergences, NIPS 2018
[R3] QuantTree: Histograms for change detection in multivariate data streams, ICML 2018
[R4] Differentially Private Change-Point Detection, NIPS 2018
[R5] M-Statistic for Kernel Change-Point Detection, NIPS 2015
[R6] Kernel Change-point Analysis, NIPS 2008

(5) Why not include recent methods such as [R2] (see above) as competitors for comparison in Section 4?

(6) From Tables 1 & 2 shown in supp., the proposed ARC and aARC do not always obtain the lowest mean error as compared with others. It is not obvious (from the results in supp.) that the proposed ARC and aARC are better than others in terms of mean error.  Also, the cases {0.1, 2, 1} and {0.2, 2, 1} (etc.) are not found in Supp.  I suppose the performance results in supp. should be more comprehensive and a superset of the cases reported in the main paper.

(7) [44] demonstrates the use of many different datasets to evaluate various change point detection methods.  Why not use the datasets mentioned in [44]?

=======================================================

Other issues:

You may use a heatmap visualization to tabulate all the results here.

Line 101: should f be

Line 103: please double check the subscripts here.

Line 109: better to mention "in the supplementary material" after Definition A.1.

Line 226: widow -> window

Line 227: please add a note on the meaning of the math symbol between h and L here

Between line 236 and 237: what if epsilon is 0.1?
 The paper does not explicitly list down the limitations.

 Thank you very much for your appreciation and constructive comments.  In the following, we provide responses to the main points that you raised.  We are grateful to you for catching the typos.  Should this paper be accepted, we would incorporate your suggestions in the revision. 

__Point 1__: 

__On adaptive adversary.__  _[As is pointed out in Sec 5, it would be nice to extend the model assumption to adaptive adversary ... the difference between the Huber contamination and adaptive adversary is not significant in mean estimation and the optimal error rate is the same...]_  

__Answer__:  Thank you for your questions.  Regarding the adaptive adversary, thank you very much for your suggestion and it is indeed one of our future directions.  Despite that the difference between the adaptive adversary framework and the dynamic Huber framework (Assumption 1)  is not significant in mean estimation, we would like to point out that they have different implications for the task of localising change points. 

Intuitively, Assumption 1 requires the contamination to `spread evenly' across the data sequence while the adaptive adversary is able to manipulate a consecutive sequence of points.  To be specific, in the adaptive adversary framework, $\varepsilon n$ contaminated points can be placed right next to a change point and incur a localisation error of $\varepsilon n$.  When $\varepsilon = O(1)$, as we have shown in Lemma 2, under the dynamic Huber assumption, the localisation error can still be of the order $\kappa^{-2} \sigma^2$, up to a logarithmic factor; while in the adaptive adversary framework, the localisation error is of order $n$, which suggests inconsistency in change point localisation in the sense of (3). Due to its significant impact on the localisation error rate, we plan to leave the investigation under the adaptive adversary framework as a future direction.

__On lower bounds in Lemma 2__. _[I am confused why the author(s) claims that "the optimal localisation error is of the same order compared to the situation when no contamination exists", as the Lemma 2 clearly factors $\varepsilon$ into the error bound.]_ 

__Answer__: Regarding the lower bound claim, it is established in the existing literature that the localisation lower bound when no contamination exists ($\varepsilon = 0$) is 
$$1 \vee \frac{1}{2}\frac{\sigma^2}{\kappa^2}e^{-2}.$$
Consider the two terms appearing in the lower bound claim in Lemma 2.  Provided that $\varepsilon$ is bounded above from $1/2$, the first term is of the same order as the optimal localisation rate shown above.  The second term, which only depends on $\varepsilon$, is of $O(1)$ provided that $\varepsilon$ is bounded above from $1/2$.  Therefore, although the localisation error increases as $\varepsilon$ increases, it is still of a constant order.  Taking the maximum of these two terms yields the same localisation error as the order shown above.  

__Point 2__: on the extension to higher dimensions. _[The paper fails to extend the model or algorithm to high dimensions. Such generalizations may be within reach... The simple scanning idea of this paper also works...]_

__Answer__: Thank you for the suggestions.  We regard this as the first attempt to understand the fundamental limits in change point detection, in the dynamic Huber contamination models, which allows for different contamination noise distributions at different observations.  This general framework includes a wide array of specific adversarial attacks, from simply adding heavy-tailed noise to more sophisticated structured contamination. As for the first attempt in such a level of generality, we focus on the univariate case, serving as the blueprint and benchmark for more complex data types. 

Specifically for high dimensional data, we note that the study of robustness beyond the univariate case is considerably more difficult (although substantial progress has been made in recent years in designing efficient algorithms as you have mentioned), we would like to understand the impact of the contamination across different coordinates on data with time ordering more thoroughly and therefore we leave it as a future direction.   

__Point 3__: on the choice of the robust mean estimator. _[It is unclear why the author(s) has to appeal RUME for robust mean estimation...]_

__Answer__: Thank you very much for your suggestions.  We agree that there exist other robust mean estimators.  In this paper, focusing on the univariate case, we adopt the RUME as a method that achieves optimality and which is computationally efficient.  In our future work, we will investigate other robust estimators for more complex data types.

__Point 4__: on the condition of $\varepsilon$. _[... line 236 requires $\varepsilon<0.1$. The authors should make clear what the breakdown point is...]_

__Answer__: Thank you for your question. The second regime in lines 236-237 describes the case when $\varepsilon >0.1$ and the algorithm can tolerate at most $\varepsilon < 1/4$ if $\kappa/\sigma$ is sufficiently large.  

 Thank you very much for your appreciation and constructive comments.  In the following, we provide responses to the main points that you raised.  We are grateful to you for catching the typos.  Should this paper be accepted, we would incorporate your suggestions in the revision. 

__Point 1__: on the Introduction section.  _[Section 1.1 should discuss why the proposed method is not a straightforward adaptation of the existing Huber epsilon-contamination model.]_

__Answer__:  Thank you for your suggestion.  We will add more discussions in the revision.  In this paper, we consider the change point detection and localisation problems in the dynamic Huber $\varepsilon$-contamination model.  In the existing literature, there have been separate results on Huber $\varepsilon$-contamination model without the consideration of change points and change point detection problems without the consideration of contamination. More relevantly, there have been results on change point detection robust against i.i.d.~heavy-tailed additive noise.  We are the first attempt in discussing the robust change point detection at such a level of generality, allowing a wide range of structural attacks. In terms of the technical difficulties, our proposed method is not a straightforward adaptation of the existing literature due to the presence of potentially multiple change points. Establishing the phase transition phenomenon and discussing the optimality of our method under this new framework is also not straightforward. 

__Point 2__: on the computational cost analysis. _[There should be an experiment on time performance to show actual "timing" statistics as compared with the existing methods for different data set size.]_
 
__Answer__:  Thank you for your comment.  In the paper (lines 212-215), we have included a brief complexity analysis.  As for numerical results on timing statistics, we fear it would not be a fair comparison due to the software and coding details deployed by different competitors.

__Point 3__: on the tuning parameter selection.  _[Are the results sensitive to h? ...Why smaller h for real data, how small is small? If we use different values for h on the same data, how will the change point vary? There should be an experiment of the sensitivity of the results to h.]_

__Answer__: Thank you for your questions. Due to the involvement of unknown quantities, the theoretical guidance on the choice of $h$ is not practical. Intuitively speaking, $h$ should not be larger than the minimal spacing $L$ to avoid multiple change points present in the same scanning window, and should not be smaller than the order of $\log(n)$, which is necessary for mean estimation problems.  Based on this understanding, we have conducted the sensitivity analysis in the paper by using a fixed choice of $h = 20\log(n)$ and varying $L$'s in the simulations.  From the sensitivity analysis point of view, this design is equivalent to fixing $L$ and varying $h$; from the aspect of varying the problem difficult levels, this design explores a wide range of difficulties. Should this paper be accepted, we will provide more sensitivity analysis to demonstrate a more comprehensive picture.

In terms of the numerical results, Table 2 in the supplementary material suggests that our result is not very sensitive to the choice of $h$, when $h < L$. As in the real data analysis, some preliminary \emph{ad-hoc} results suggest a smaller $L$, which leads us to a smaller $h$.

__Points 4 \& 5__: on more references. _[Why not include recent methods such as [R2] Doubly Robust Bayesian Inference for Non-Stationary Streaming Data with ß-Divergences, NIPS 2018 as competitors for comparison in Section 4?]_

__Answer__: Thank you for bringing these references to us and we shall add them in the revision.  The method studied in [R2] is not originally included as a direct competitor since it is about the online change point detection problem, while our focus is the offline change point detection.  Should this paper be accepted, we will try to include more comparisons with the method in [R2].  The methods that we considered as competitors are also recent works such as BIWEIGHT from Fearnhead and Rigaill (2019) and R\_UStat from Yu and Chen (2019).

__Point 6__: on numerical results. _[From Tables 1 \& 2 shown in supp.,... It is not obvious that the proposed ARC and aARC are better than others in terms of mean error. Also, the cases {0.1, 2, 1} and {0.2, 2, 1} are not found in Supp.]_

__Answer__:  Thanks for catching this. Indeed, these two cases should have been included in Table 1 in the supplementary material and we will edit it accordingly. We agree that our proposed methods do not uniformly outperform all the competitors. As we mentioned in lines 317-319, our algorithm under-performs with respect to the competitors when they can correctly detect the change points (not fooled by the adversarial contamination). However, we are glad that our methods have consistent performance across all settings, and especially we outperform our competitors in terms of detecting true change points. In fact, some loss in localisation accuracy is inevitable as the cost of preserving robustness.

__Point 7__: on more real data analysis. _[[44] demonstrates the use of many different datasets to evaluate various change point detection methods. Why not use the datasets mentioned in [44]?]_

__Answer__:  Thank you for your question.  In this paper, we consider three real data sets, one of which is the well-log data set, included in [44].  In Section E.3.1 of the supplementary material, we evaluate the performance of our algorithm on the well-log data set using the covering metric (adopted in [44]) and compare it with competitors considered in [44].  The other two real data sets are first time analysed in the statistical literature and are of particular timely interest.  Due to the lack of ground truth, we do not follow the evaluation methods in [44]. 

__On the limitations__ _[The paper does not explicitly list down the limitations.]_

__Answer__: Thank you for your comment.  We indeed do not have a specific list of limitations, but we have thorough discussions on the limitations of our theoretical, methodological, and numerical results, along with the discussions of our contributions throughout the paper. Please refer to our answer to question 1(b) in the Checklist for the details.

 Thank you very much for your appreciation and constructive comments.  In the following, we provide responses to your comments.

__On complexity analysis__. _[...it would have been good to see some form of brief complexity analysis...]_

__Answer__: In lines 212-215, we provide a brief complexity analysis of the computational cost of our algorithm.  We copy it here for your convenience.

_Lastly, we note that the computational complexity of arc is of order $O(nh\log(h))$, where the term $h\log(h)$ is from ranking the data to find the shortest interval involved in rume. Even though the worst case complexity is $O(n^2\log(n))$, it is still more efficient than the existing methods such as the penalised biweight loss approach with computational complexity $O(n^3)$._


__On the real data analysis__.  _[A quantitative summary of the accuracy results on the real-life data sets would be useful.]_

__Answer__: Thank you for your suggestion.  In Section E.3.1 of the supplementary material, we have included quantitative results of the well-log data set.  This is based on some human annotations of the ground truth obtained in [1].  In addition to the well-log data set, we have also analysed two air pollution data sets, which are new addition to the literature and we do not have justified ground truth for further quantitative analysis.

[1]  van den Burg, G. J., \& Williams, C. K. (2020). An evaluation of change point detection algorithms. arXiv preprint arXiv:2003.06222.

The paper addresses the problem of change point detection for univariate time series in the presence of adversarial attack through the introduction of data perturbations. A novel method is introduced for this problem based on a robust variant of the CUSUM statistic that uses robust mean estimators. The proposed method is supported by theoretical guarantees of the consistency of change point estimation in the presence of adversarial attacks according to the level of contamination.  Originality: The problem of change point detection in the presence of adversarial attack has received little attention, and the proposed approach is an extension of traditional approaches, but with solid theoretical guarantees of robustness. The paper provides an interesting and relevant new branch of research in the field of adversarial machine learning.

Quality: The paper provides detailed theoretical analysis of the properties of the proposed algorithm, as well as systematic evaluation of its performance on both synthetic and real-life datasets under a variety of adversarial attacks. The baselines used for evaluation include traditional change point detectors as well as more recent robust estimators.

Clarity: The paper is clearly structured and very well written. The evaluation methodology is described in sufficient detail. While the graphical presentation of the results on the real-life time series was interesting, it would help if this was accompanied by a more quantitative summary of the detection rate, false positive rate and localisation error for each method. I couldn’t see this in the supplementary material.

Significance: The paper has considerable practical significance in terms of addressing the robustness of change point detection, which has practical use in a wide range of application domains, such as fault detection and cyber security. The paper also provides a detailed theoretical framework from which to provide guarantees of the robustness of estimation using the proposed method.
 The authors highlight that their robust change point estimation technique is computationally feasible. It would have been good to see some form of brief complexity analysis to quantify this point.

A quantitative summary of the accuracy results on the real-life data sets would be useful.

The paper addresses the problem of change point detection under Huber contamination model. The work gives tight bounds on the minimax error as well as a simple, efficient algorithm for achieving it.   Significance
----
Change point detection is a fundamental question in statistics, with applications to various areas. The paper tackles an important problem of designing robust algorithm for it. 

Originality
-----
The paper combines known techniques in robust estimation (RUME) and change point detection (CUSUM). I believe this combination, though natural, has not appeared in the literature. On the other hand, the paper does not introduce new (algorithmic) techniques.

Quality
----
The theoretical claims are correct.  The paper appears to be a full result, as the theorems settle the question almost completely. However, it has a few limitations, as I will point out later. 


Clarity
----
The paper is generally well-written. It's probably hard to do within the space limit, but a reader may like to see more intuition explaining the theorems and the algorithm.



Other minor points on writing
---

Line 51: “paper” -> “papers”

Line 93: redundant reference to [32]

Line 102: it’s hard to parse the notation $F_{\eta_{k}+1}=\ldots=F_{\eta_{k+1}}$. Maybe expand the ellipsis a little bit.

Line 3 of Algorithm 1: it's better to write "for $j \in \{ 2h, 2h+1, … , n-2h \}$". I made an incorrect interpretation of the ellipsis for my first reading.

Line 194: "the closest related" -> "most closely related" Limitations
---
1. As is pointed out in Sec 5, it would be nice to extend the model assumption to adaptive adversary (that is, the adversary can examine the data and arbitrarily modify it), recently studied in robust estimation literature. I am confused why the author(s) claims that "the optimal localisation error is of the same order compared to the situation when no contamination exists", as the Lemma 2 clearly factors $\epsilon$ into the error bound. As far as we know, the difference between the Huber contamination and adaptive  adversary is not significant in mean estimation—the optimal error rate is the same, and the same set of algorithms (e.g., filter or convex programming) work for both.

2. The paper fails to extend the model or algorithm to high dimensions. Such generalizations may be within reach. High-dimensional analog of robust mean estimation algorithms exist, and some of them, such as median-of-means, achieve strong sub-gaussian tail guarantees, similar to RUME. (I understand that a sub-gaussian tail is needed here, so just being robust is not enough.) The simple scanning idea of this paper also works for, say, $\ell_2$ norm.

3. It is unclear why the author(s) has to appeal RUME for robust mean estimation. There are simpler choices, such as median-of-means and trimmed means, that achieve same guarantees in the univariate setting. Note that RUME is not computationally efficient in high dimensions.  This prevents extending the results here.


4. Assumption 1 states that $\epsilon$ can be taken all the way to $1/2$, and Theorem 1 inherits this assumption. However, line 236 requires $\epsilon <1/10$. The authors should make clear what the breakdown point is. It would be great if the algorithm achieves the optimal breakdown point of $1/2$. 

Societal Impact
---
Since it is mostly theoretical, I believe the work will not make potential negative societal impact.

Meta-review: The paper gives an adversarially robust way to perform change point detection in univariate time series analysis. Adversarial robustness in this context has not been considered before, and this paper provides a new algorithm as well as empirical evidence.

Decision: accept