Backdoor Attacks on Time Series: A Generative Approach
Abstract —Backdoor attacks have emerged as one of the major security threats to deep learning models as they can easily control the model’s test-time predictions by pre-injecting a backdoor trigger into the model at training time.
While backdoor attacks have been extensively studied on images, few works have investigated the threat of backdoor attacks on time series data.
To fill this gap, in this paper we present a novel generative approach for time series backdoor attacks against deep learning based time series classifiers.
Backdoor attacks have two main goals: high stealthiness and high attack success rate.
We find that, compared to images, it can be more challenging to achieve the two goals on time series.
This is because time series have fewer input dimensions and lower degrees of freedom, making it hard to achieve a high attack success rate without compromising stealthiness.
Our generative approach addresses this challenge by generating trigger patterns that are as realistic as real-time series patterns while achieving a high attack success rate without causing a significant drop in clean accuracy.
We also show that our proposed attack is resistant to potential backdoor defenses.
Furthermore, we propose a novel universal generator that can poison any type of time series with a single generator that allows universal attacks without the need to fine-tune the generative model for new time series datasets.
I. I NTRODUCTION
Time series captures a sequence of observations with measurable quantities indexed by timestamps.
It is amongst the most ubiquitous data types in a wide range of industries, such as finance [1], heavy industry [2] and healthcare [3], [4].
Similar to the computer vision field, deep neural networks (DNNs) are often used in time series analysis to achieve stateof-the-art performance [5], [6], [7].
However, DNNs are known to be vulnerable to backdoor attacks where the adversary aims to control the model’s test-time prediction behaviors by implanting a backdoor trigger into the model at training time [8], [9].
This has raised security concerns with the deployment of DNN models in safety-critical applications.
Backdoor attacks represent one type of training-time vulnerabilities of DNNs, which are different from test-time adversarial attacks [10], [11], [12].
To implant the backdoor trigger into a target model, the adversary can either poison a small fraction of the training data with a trigger pattern [8] or directly manipulate the training procedure [9].
The former could occur during the data collection process, while the latter could happen to outsourced model training or the use of pre-trained models downloaded from untrusted sources.
A backdoored model predicts the correct classes on clean test inputs yet will constantly predict the backdoor class whenever the trigger pattern appears.
Backdoor attacks have been extensively studied on images with DNN-based image classifiers, however, few works have investigated the potential backdoor vulnerability of DNNbased time series models.
The two main objectives of backdoor attacks, namely high attack success rate (ASR) and high stealthiness, have been achieved on images as demonstrated by many existing works [8], [13], [14], [9], [15].
The effectiveness of backdoor attacks is closely associated with their trigger patterns, which are often designed to be fixed patterns or dynamic but sparsely distributed patterns for images.
However, unlike images, time series are generally of lower dimensions (e.g., univariate) and fewer degrees of freedom (e.g., limited window length).
It thus makes fixed patterns more noticeable (less stealthy) on time series.
In fact, it is still unclear whether fixed patterns are effective on time series.
Moreover, time series are of diverse types, such as stock prices, temperature readings, weather data, and heart rate monitoring, to name a few.
As such, fixed patterns can hardly be effective on all types of time series.
In this paper, we present a novel generative approach for generating stealthy and sample-specific trigger patterns for effective time series backdoor attacks.
By leveraging generative adversarial networks (GANs), our approach can generate backdoored time series (the original time series plus the trigger pattern) that are as realistic as real-time series, while achieving a high attack success rate.
Furthermore, by training the trigger pattern generator on multiple types of time series, we can obtain a universal generator.
The universal trigger generator demonstrates high flexibility in performing backdoor attacks on different types of time series across different domains, revealing the significant threat of backdoor attacks to time series analysis.
Our work provides a practical solution to stealthy and effective time series backdoor attacks, and reveals the potential backdoor vulnerability of DNN-based time series classification models.
In summary, our main contributions are:
• We study the problem of backdoor attacks on time series and propose a novel generative approach for crafting stealthy sample-specific backdoor trigger patterns.
We also reveal the unique challenge of time series backdoor
attacks posed by the inherent properties of time series, ( i.e., low dimension and limited degrees of freedom).
• We empirically show that our proposed attack can generate stealthy and effective backdoor attacks against stateof-the-art DNN-based time series models and is resistant to potential backdoor defenses.
The attacked models also have minimal clean accuracy drop on both univariate and multivariate datasets.
• We present a novel universal backdoor attack that is capable of crafting sample-specific backdoor triggers for different types of time series across a wide range of domains.
With a one-time training on a combination of time series datasets, the proposed universal attack can succeed 70% of the time under the poison-label setting.
II. R ELATED W ORK
In this section, we briefly review existing works in backdoor attack and defense that are most relevant to our work.
A. Backdoor Attack
A backdoor attack implants a backdoor trigger into the victim model by injecting the trigger pattern into a small proportion of the training data.
It preserves the model’s performance on benign (clean) inputs but can manipulate the model to constantly predicts the attacker-specified backdoor class whenever the trigger pattern appears in a test input.
1) BadNets: BadNets [8] is the first backdoor attack that was designed for image classification models.
With an attacker-specified backdoor label y t , BadNets first stamps a pre-designed backdoor trigger onto a benign image x to generate a poisoned sample x ′ and changes its ground-truth label to y t .
It then trains a backdoored model on the poisoned training data of which a small portion of the samples are poisoned following the above procedure.
At inference time, the attacked model performs well on benign test samples, yet consistently predicts the backdoor label y t for any test samples with the trigger pattern attached.
Using a simple checkerboard pattern, BadNets can achieve an attack success rate ( i.e., the ratio of poisoned test samples that are predicted as the backdoor class) of 99% on MNIST dataset by poisoning only 10% of the training data.
In Section IV-A, we will propose a simple BadNets-equivalent baseline attack for time series.
2) Invisible patterns: Following BadNets, a number of backdoor attacks have been proposed in computer vision applications with images.
[13] first discussed the stealthiness of backdoor attacks in regard to the invisibility requirement of trigger patterns.
They suggested that poisoned images should be indistinguishable from their benign counter-part to evade human inspection.
Accordingly, they proposed a blending strategy that generates poisoned images by blending the backdoor trigger with benign images, instead of direct stamping.
A small-amplitude random noise is then added to further reduce the risk of being detected.
After [13], a series of works have been proposed to generate invisible trigger patterns, which include [9], [14], [15], [16].
All these works were proposed for images.
In [17], a video backdoor attack was proposed against video recognition models.
It leverages universal adversarial perturbations to tackle the higher dimension challenge posed by videos.
Backdoor attacks have also been extended to other vision tasks such as crowd counting [18] and visual object tracking [19].
In this work, we will also limit our patterns to be invisible, but address the lower dimension challenge posed by time series.
3) Sample-specific patterns: The above-mentioned backdoor attacks all use a fixed pattern at a fixed location of the image as the trigger pattern, which could potentially be defended and removed easily.
To address this problem, [20] proposed an input-aware backdoor attack to generate different backdoor trigger patterns for different input samples, enforcing each trigger pattern to be only functional for one particular input sample.
Similarly, [21] proposed LIRA that can generate the optimal trigger while successfully poisoning the classifier in computer vision applications.
Most recently, inspired by DNNbased image steganography, [22] proposed another samplespecific backdoor attack via encoding an attacker-specified string into benign images, which generates sample-specific additive noises as backdoor triggers.
For stealthiness, in this paper, we are also interested in sample-specific backdoor attacks.
4) Time series attacks: [23] studied backdoor attacks against transfer learning on both image and time series data.
Particularly, they proposed to manipulate the pre-trained teacher models to generate customized student models that make the wrong predictions.
However, the times series (e.g.
ECG signals) were transformed into 1D or 2D images and attacked based on image backdoor attacks.
[24] proposed
TrojanFlow to perform backdoor attacks against network traffic classification models.
By poisoning the traffic flow in a stealthy manner, this attack achieves high ASRs on both flow-based and payload-based classifiers.
More recently, [25] proposed a backdoor attack TimeTrojan on time series classifiers.
TimeTrojan proposes a multi-objective optimization framework to help the model learn a strong correlation between the trigger pattern and the target class.
There are also backdoor attacks that are not realized via data poisoning but direct modifications of the model parameters [26], [27] or structures [28], [29], [30].
These attacks are independent of poisoning-based attacks and can be performed even after a poisoning-based attack.
In this paper, we will focus on data poisoning-based attacks and leave other types of manipulations to future work.
Particularly, we propose a generative approach for time series backdoor attacks that produce both realistic and effective sample-wise backdoor triggers.
B. Backdoor Defense
A large number of defense methods have been proposed to mitigate the backdoor threat via detection or purification.
Neural Cleanse [31] presented the first solution to detect poisoned models.
It first computes potential trigger patterns for each class that could convert any clean image to that class.
Then, it detects among these candidates and selects the abnormally smaller ones as backdoor indicators.
Following [31], improved detection techniques were introduced in [32], [33].
Fine-Pruning [34] purifies a backdoored model by eliminating neurons that are dormant on clean inputs.
Knowledge distillation (KD)
[35] techniques were also leveraged in [36] and [37] to remove backdoors from infected DNNs.
However, applying Fine-Pruning and KD could degrade the clean accuracy when only limited clean data are available [38].
[39] proposed to remove neurons with high activation values from the final convolutional layer.
More recently, a robust training strategy was proposed in [40] to train backdoor-free models on the poisoned dataset.
[41] introduces an effective backdoor removal method Adversarial Neuron Pruning (ANP) to prune adversarially sensitive neurons to purify the model.
In this paper, we present a novel generative time series backdoor attack that can produce backdoor samples that are not detectable by either human inspectors or strong backdoor defenses.
III. T IME S ERIES B ACKDOOR A TTACK
In this section, we introduce our proposed Time Series Backdoor Attack (TSBA) in the context of time series classification (TSC).
We first define our threat model and overview the attack pipeline, then introduce the details of the proposed trigger generator and its training procedure.
Finally, we introduce how to train a universal trigger generator to craft sample-specific backdoor triggers for any type of time series.
A. Problem Formulation
Let D =
( x i , y i ) } Ni =1 denote the benign training set of N i.i.d.
samples, where each x i represents one time series sample and y i is its corresponding ground-truth label.
A classification model f learns the function f : X → Y that maps the input space to the label space.
This is typically done by minimizing the model’s classification error on D as follows:
[Equation]
where L CE is the commonly used cross-entropy loss and θ are the model parameters.
A backdoor adversary poisons the training data D into a poisoned dataset D ′ with a trigger pattern p such that the model trained on D ′ will become a backdoored model f ′ .
With the trigger pattern p , a poisoned sample can be crafted by x ′ =
x ⊙ p where ⊙ represents any stamping method, such as addition, subtraction, or replacement.
The adversary aims to achieve two goals with the backdoored model f ′ .
First, the model should predict the correct label for benign inputs, i.e., f ′ ( x ) =
y for any test input x ∈ D test .
Second, the model should predict the backdoor class y t for any stamped test input with the trigger pattern, i.e., f ′ ( x ′ ) =
y t for any backdoored test input x ′ .
B. Threat Model
Existing threat models from the adversary’s perspective can be categorized into three main categories: 1) training manipulation where the adversary not only poisons the training data but also controls the training procedure [15], [20], [42]; 2) data poisoning where the adversary can only poison the training data with the trigger pattern [8], [13]; and 3) post-training injection where the adversary does not poison the training data nor control the training procedure, but directly modifies the parameters of a cleanly-trained model [43].
Unlike most image backdoor attacks that only consider one of the above three threat models, in this paper we design and evaluate our
Time Series Backdoor Attack (TSBA) under two different threat models that fall into categories 1) and 2) stated above, denoted as TSBA-A and TSBA-B :
TSBA-A : This threat model simulates real-world scenarios where the victim users directly download and deploy pretrained DNNs models from untrusted sources.
Under this threat model, the adversary has full access to the training data D with complete control over the training procedure.
Accordingly, the adversary purposely trains a backdoored model f ′ with the poisoned training data D ′ which contains a small portion of poisoned samples by sample-wise trigger pattern p .
After downloading the backdoored model f ′ , the victim user is expected to inspect the model’s performance on its own validation data D val which is unknown to the adversary.
TSBA-B : This threat model assumes the victim users have full control over the training procedure but accidentally collected a few poisoned samples into its training set.
The adversary may have knowledge of the network architecture adopted by the victim, and can poison a small number of training samples.
The adversary can thus add sample-wise trigger patterns to a few samples and then injects the samples into the training set.
The victim trains a backdoored model f ′ on the poisoned dataset D ′ .
Meanwhile, the victim may inspect the poisoned dataset D ′ via either visual inspection or certain backdoor defense techniques to remove the backdoored samples.
C. Proposed Attack Pipeline
[Figure]
As illustrated in Figure 1, our proposed TSBA attack trains a trigger generator network to generate sample-specific backdoor trigger patterns for poisoned samples.
The adversary randomly selects 10% of training data for backdoor poisoning, and trains a time series classifier on both the poisoned and clean training samples.
To achieve both a high attack success rate and high clean accuracy, the two components of TSBA, namely the trigger generator and the classifier, are trained iteratively via specific procedures described in Section III-D. At inference time, the backdoored classifier will predict the adversaryspecified class (backdoor class y t ) for poisoned samples, while recognizing correct classes for clean samples.
Under the TSBA-A threat model, the adversary directly releases the backdoored classifier to the victim user, while privately keeping the trained trigger generator to perform backdoor attacks at inference time, i.e., as our TSBA is a sample-specific attack, the adversary will need the trigger generator to produce backdoor samples at inference time.
Under the TSBA-B threat model, the adversary will leverage the trigger generator to perform data poisoning, i.e., poisoning a small proportion (e.g. 10%) of the training samples using the trigger generator.
The victim user then trains a classifier on the poisoned training set following a typical model training procedure.
The victim user will use the trained classifier to perform inference on either clean or backdoored test samples.
The inference procedure is the same as in TSBA-A .
Algorithm
1 Let f be the classifier, g be the trigger generator 2 Let clip ξ ( x ⊙ k ) limit x bounded by [ k − ξ, k + ξ ] 3 Let G ξ ( x ) = clip ξ ( g ( x ) ⊙ x ) 4 Given a target class y t , a training dataset D , the backdoor poison rate γ 5 T clean : clean training epochs; T backdoor : backdoor training epochs 6 Initialize f, g 7 # warm start f 8 for i in range ( T clean ) do for ( x , y ) in D do f ← arg min f L CE ( f ( x ) , y ) end 12 end 13 # simultaneous training of g and f 14 D ′ ← random sample γ ( D ) 15 for i in range ( T backdoor ) do for ( x ′ , y t ) in D ′ do g ← arg min g L CE ( f ( G ξ ( x ′ )) , y t ) end
D ′ ← D ∪ { G ξ ( x ) , y t } for ( x ′ , y ′ ) in D ′ do f ← arg min f L CE ( f ( x ′ ) , y ′ )
end 23 end 24 return f , g
The core component of TSBA is the trigger generator which uses a simple DNN architecture suited for both univariate and multivariate time series.
The detailed model structure is shown in Table VII.
The trigger generator takes a time series sample as an input and generates a sample-specific trigger pattern for the sample.
Test the trigger pattern is of the same size as the original sample.
Then, the generated pattern is added to the original sample to craft a poisoned sample.
Given that the trigger patterns are dynamic (sample-specific) and stealthy (ensured by the generator), it is difficult for the victim user to identify which samples are backdoored [20], [22].
Moreover, even if the victim user has detected the trigger patterns for several samples, they could not remove the trigger pattern for other samples without the trigger generator.
This is in sharp contrast to fixed-pattern based backdoor attacks, where the fixed pattern can be easily removed once detected.
D. Training the Trigger Generator
The training procedure of the trigger generator is described in Algorithm 1.
which iteratively trains the trigger generator g and the backdoored classifier f to achieve both a high attack success rate and high clean accuracy.
[Figure]
To address the cold start problem of generator training, we first pre-train the time series classifier f for T clean epochs on all clean samples from D until it has a steady drop in the crossentropy loss L CE .
This corresponds to lines 7-11 in Algorithm 1.
After this pre-training, we train the trigger generator g and the partially trained classifier f simultaneously for T backdoor epochs.
Both networks are progressively updated in each iteration following a similar process: 1) training g on the poisoned samples (initialized to be randomly sampled clean samples at line 13) to minimize the classification loss with respect to the backdoor class y t (line 15-17); 2) generating poisoned dataset D ′ using g (line 18); and 3) training f on the poisoned dataset D ′ with the poisoned samples are relabeled to y t (line 19-21).
Note that during the entire process, the backdoor trigger pattern is clipped to be within 10% of the signal amplitude, i.e., 0 .
1 ∗ ( x max − x min ) , to strengthen stealthiness (line 2).
This process is further illustrated in Figure 2.
This training procedure encourages the trigger generator g to explore the most effective patterns that can alter f ’s predictions towards the target class y t .
Unlike the image backdoor training where the backdoor samples are generated before model training, we refresh the sample-specific trigger for each backdoor sample using the updated trigger generator g .
Likewise, the time series classifier f is backdoor trained to minimize the CE loss on the partiallypoisoned training data.
Thus, it enables the classifier to recognize the backdoor pattern induced by the trigger generator, while maintaining clean accuracy with clean training samples.
How TSBA works?
In TSBA, the generator is designed to progressively generate stronger (and more realistic) trigger patterns, while the classifier simultaneously learns the correlation between the trigger patterns and the target class.
This design is motivated by our observation in Section IV-D that simple trigger patterns cannot be easily learned into the model.
I.e., establishing the backdoor correlation is relatively hard in time series models.
The clean signals tend to overwhelm the backdoor noise during the training process.
As such, the generator and the classifier need to learn together to explore stronger triggers.
Beyond time series backdoors, our design could also be useful for scenarios where backdoor triggers are generally hard to inject.
E. Training a Universal Trigger Generator
The above generator needs to be re-trained or fine-tuned for a new type of time series.
Here, we further train a universal trigger generator to generate sample-specific triggers for any type of time series without the need to fine-tune the generator for unseen datasets.
The universal generator has a similar architecture as the dataset-specific trigger generator used in the above TSBA algorithm, but with one additional convolutional layer and revised parameters to provide more generalization capacities for multiple time series datasets.
The detailed model architecture can be found in Table VIII.
1 Let g be the universal trigger generator 2 Given a set of distinct time series datasets
S =
{S 1 , S 2 , ..., S n } 3 Let C = { 1 , 2 , ..., n } be a class set 4 Initialize g 5 for
i in range ( T u ) do
S ′ ← random sample ( S ) y t ← random select ( C ) g ← TSBA( g, S ′ , y t )
▷ following Algorithm9 end 10 return g
As described in Algorithm 2, it generally follows the training procedure of TSBA with several extra steps.
The generator is trained with samples from a combination of time series datasets which are merged with all class labels re-organized.
In each iteration, the generator is refreshed with randomly selected training samples and target classes.
Accordingly, the generator is optimized to create the trigger pattern according to the style of the time series input to perturb samples from unseen datasets.
Thus, it simplifies and automates the procedure of trigger pattern selection by removing the necessity for manual selection or training a dataset-specific trigger generator.
More detailed training setup can be found in Section
IV.
IV. E XPERIMENTS
In this section, we evaluate the performance of our proposed
TSBA and the universal trigger generator.
We first introduce three simple baseline attacks and describe our experimental setup.
We then discuss the experimental results and show the differences between image vs. time series backdoor attacks.
Following that, we demonstrate the stealthiness of the backdoored samples generated by TSBA, as well as its resistance to backdoor defenses.
A. Simple Baseline Attacks
In this work, we also propose three image-equivalent methods of time series backdoor attacks.
Due to the lack of prior research on time series backdoor attacks, we use them as the baseline attacks.
The attacked waveforms by the 3 baseline attacks are illustrated in Figure 3.
The first two baselines are the two versions of a vanilla backdoor attack: 1) adding a fixed pattern at the beginning of the time series, or 2) covering the peaks (or troughs) in the time series by a fixed pattern.
Here we set the fixed pattern to be the min/max value of the entire time series, as they are the most salient signals. Both baseline attacks randomly choose and alter 5% of the time series dimensions alternatively to their maximum and minimum signal values.
The third baseline attack, named static noise , uses static powerline noise as the trigger pattern.
This idea was motivated by the observation in recent research that powerline noises caused by the signal capture device commonly exist in Electrocardiogram (ECG) signals [44], [45].
The noise is tiled (repeated) to the same length as the original time series and applied to all time-dependent dimensions.
Also, it is standardized with its size set to be 10% of the amplitude ( x max − x min ), which is of the same amplitude as the patterns generated by our TSBA.
B. Experimental Setup
We evaluate our TSBA under both threat models TSBA-A and TSBA-B (introduced in Section III-B) on 13 time series datasets, where 8 of them are univariate datasets from the
UCR Archive, and the rest 5 are multivariate datasets from the MTS Archive.
Statistics of the 13 datasets can be found in Appendix A. Due to the small number of instances and the non-typical train-test split for most datasets, we apply 10fold cross-validation for all of our experiments and report the average clean accuracy (CA) and attack success rate (ASR).
The poisoning rate for all attacks is set to be 10%.
For better stealthiness, the backdoor trigger pattern is clipped to be 10% of the signal amplitude ( x max − x min ) for each sample.
For TSBA-A and the three baseline methods, we directly take the backdoored classifier as the final classifier.
For TSBA-B , the final classifier is trained with the 10%-poisoned training dataset by the trained trigger pattern generator.
We select the first class of each dataset as the backdoor class.
Details of all network architectures can be found in Appendix A.
We first warm start the time series classifier by training it for 20 epochs with purely clean samples.
Then, we train each model for 500 epochs and apply early stopping to avoid overfitting.
The training is terminated when the backdoored classifier achieves an optimal ASR and CA on the validation set according to the 10-fold cross validation.
[Figure]
[Table]
[Figure]
Clean Signal
[Figure]
TSBA
[Figure]
F r e q .
[Figure]
o m a i n
[Figure]
C. Main Results
The attack performance of different attacking methods is reported in
Table I.
It is clear that our proposed TSBA-A and TSBA-B attacks achieved the best attack performance among all the baseline attacks, in terms of both ASR and
CA.
Specifically, TSBA-A achieves 100% ASR in 19 out of the 39 experiments, while an average ASR of 98.2% in the rest of the 20 experiments.
The average clean accuracy drop is around 2.45% and 2.25% for univariate and multivariate datasets, respectively.
For TSBA-B , it is less powerful than
TSBA-A
but can still achieve an average ASR of 81.6%.
It causes an average clean accuracy drop of 5.09% and 4.63% for univariate and multivariate datasets, respectively.
Surprisingly, as a weaker attack, the CA performance of TSBA-B is no better than TSBA-A .
We suspect this is because TSBA-B has zero control over the training procedure and does not have the benign counterparts of the poisoned samples in the training set.
Compared with static noise, our TSBA-B achieves significantly higher ASR in all experiments while maintaining similar clean accuracy in most cases.
These results confirm the attack effectiveness of our proposed TSBA attacks.
D. Time Series vs. Images
As shown in Table I, directly applying image-equivalent backdoor attacks ( i.e., the two variants of vanilla backdoor) on time series data fails to deliver strong attack performance as in the image domain.
This is because time series are generally of lower input dimensions and fewer degrees of freedom than images, making fixed trigger patterns less effective.
The fast and steep shifts induced by the vanilla backdoor patterns may not be sensitive to the classifier and could be suppressed by the clean peak or trough signals.
Even for the variant that randomly applies the trigger pattern to cover one or more peaks (or troughs), it could only improve the ASR by an average of 1.63% while reducing the clean accuracy by an average of 2.53%.
In fact, effective trigger patterns should produce smooth transitions across the entire signal.
By simply adding the static powerline noise with a small 10% (standardized) amplitude, it achieves significantly higher ASRs and CAs compared with the vanilla backdoor.
Our TSBA attacks present a more advanced version of the static noise that can generate more smooth and persisting trigger patterns, and more importantly, be adaptive to each input time series.
E. Stealthiness Analysis
We use the root mean square (RMS) of the trigger patterns to measure their stealthiness.
We apply the trained trigger generator to create sample-specific trigger patterns for all samples in each of the 13 datasets, then report their mean
RMS values within each dataset as well as the average overall 13 datasets.
To simplify the results, this experiment was conducted under the TSBA-A threat model based on the FCN, one most commonly used model architectures for time series classification.
The results are reported in Table II.
highest 1% portion sorted by the absolute signal values.
D
[Table]
It is evident that our TSBA attack introduces very small variations to the original signal, only incurring an average of 2.1% of the amplitude for all samples across the 13 datasets, although we allow up to 10% perturbation of each sample’s amplitude.
It is worth mentioning that the static noise incurs an average of 10% of the amplitude, which is much higher than
TSBA.
The low top 1% RMS values indicate that only a small
[Figure]
Clean Input (Clean Model)
[Figure]
Vanilla (Fixed
[Figure] [Figure]
Noise (10% amp.)
[Figure]
-A (Ours)
[Figure]
portion of each sample is heavily perturbed, while the rest are insignificantly modified.
However, such small but samplespecific perturbations can achieve remarkably high ASR with similar clean accuracy.
Figure 4 shows that the backdoor samples and their benign counterparts are imperceptibly different from their clean counterparts in both the time domain ( i.e., waveform) and frequency domain (obtained via Fourier transformation).
Figure 5 shows the different trigger patterns crafted by different attacks.
The trigger patterns generated by our attack are very smooth and visually more natural compared to other baselines.
Note that the vanilla backdoor attack creates a high variation block at the beginning of the signal, while the static noise causes a suspicious sawtooth effect across the entire signal.
This confirms the high stealthiness of TSBA and the benefit of our generative approach.
Our proposed TSBA attacks are capable of generating stealthy backdoor triggers owing to their generative design.
F. Grad-CAM Visualization
To help understand the working mechanism of the trigger patterns generated by TSBA, we visualize the Grad-CAM [46] attention map in Figure 5 for the trigger patterns crafted by different attacks and their boosted versions.
The boosted triggers can help visualize the differences.
For the vanilla backdoor with a fixed pattern position (at the beginning), we double its perturbation magnitude from 5% to 10%.
For the static noise, we directly double the amplitude of the added noise pattern.
For our TSBA-A , we retrain the model with a doubled clipping rate ξ , from 10% to 20%.
Amongst all six backdoored samples (with their corresponding models), only our TSBA-A and its boosted version have successfully performed the backdoor attack.
Unsurprisingly, the trigger for the vanilla backdoor does not activate the hidden backdoor as its attention map is very similar to that of the original signal.
For the static noise, there is no obvious region of the altered attention map that can cause incorrect prediction.
For the enhanced version of the above baseline attacks, more lessfocused regions are shown in the attention map ( i.e., more blue regions and less yellow or red regions), indicating that those trigger sequences divert the attention of the classifier.
Yet, they are not strong enough to mislead the model’s prediction.
By contrast, with small-amplitude triggers, our TSBA can produce more disputing regions in the classifier’s attention map.
G. Resistance to Backdoor Defenses
Here, we show that our TSBA attack can easily evade state-of-the-art backdoor defense methods, including Neural
Cleanse (NC) [31], Fine-Pruning (FP)
[34] and Adversarial
Neuron Pruning (ANP) [41].
The results of our TSBA-A/B and the three baselines are reported in Table III.
1) Evading NC: NC [31] can not only detect whether a DNN has been backdoored but also recover and mitigate the backdoor trigger via reverse engineering and unlearning.
Here, we apply NC with unlearning that allows the model to decide which weights are problematic and should be updated through training.
This defense can significantly eliminate the two Vanilla baseline attacks, reducing their ASR by 42% - 62% .
However, it fails on the other 3 attacks due to its limitation on detecting static trigger patterns that are not applied to the entire input.
Since our TSBAs use sample-specific triggers,
NC can only reduce their ASRs by 1%-6%.
2) Evading FP: FP [34] exploits the advantages of both pruning and fine-tuning, and progressively removes the dormant neurons that are conditioned on clean images to mitigate the backdoor.
We apply FP with the default hyperparameters on the backdoored classifiers trained by our TSBA attacks.
We set the pruning rates to 30%.
Our TSBA demonstrates high resistance to the FP defense with less than 5% and 9% ASR drop for TSBA-A and TSBA-B, respectively.
This implies that
[Table]
the trigger patterns generated by TSBAs are deeply mixed into the clean signals in the representation space, making it hard to be removed by either neuron pruning or clean-data based fine-tuning.
3) Evading ANP: ANP [41] is a recent defense method that removes potential backdoors by pruning the most susceptible neurons to adversarial perturbations.
ANP demonstrates stateof-the-art defense performance against a number of backdoor attacks.
Here, we apply ANP to all backdoored models with a perturbation budget ϵ = 0 .
4 , trade-off coefficient α = 0 .
2 , and constant learning rate 0.2.
All neuron masks are optimized using Stochastic Gradient Descent (SGD).
ANP can significantly eliminate the two Vanilla attacks (i.e., Fixed and Random), reducing their ASRs to < 2%.
For the static noise attack, ANP brings its ASR down to less than 10% on all datasets.
Our TSBA attacks are fairly robust against this strong defense with ASR drops by < 9% .
The ASRs of the three baseline attacks are all below 10% under the backdoor defenses.
However, the ASRs of our TSBA attacks drop only by less than 10% across all 3 defenses and 13 datasets, which are still above 80%.
This proves that, even under strong backdoor defenses, our attacks can still pose high threats.
It is also worth mentioning that, since our triggers are dynamic and sample-specific, existing defense techniques designed for static patterns may not apply to our attacks.
V. U NIVERSAL T RIGGER G ENERATOR
To evaluate the attack performance of our proposed universal trigger generator, here we train the model on a combined dataset of 10 new univariate datasets from UCR Archive, namely the first 11 datasets except for D 1 BirdChicken (as Dare selected in our experiments).
The training of the generator is early stopped when an optimal ASR (on the training set) is achieved.
Then, we use the obtained universal trigger generator to create poisoned training set for each of the 13 datasets used in our previous experiments, with a poison rate of 10%.
For multivariate datasets, we apply the universal generator to each time-dependent variable separately.
Each backdoored classifier was trained following the same training procedure and setting under our TSBA-B threat model (stated in Section IV-B).
As shown in Table IV, the universal trigger generator exhibits strong performance on all 13 datasets.
The clean accuracy is generally higher than our non-universal TSBA-B attack, while the attack success rate drops by less than 4%.
Note that this attack performance still outperforms the static noise, the strongest baseline attack.
The sample-wise trigger patterns generated by the universal generator are still dynamic and equally stealthy as those generated by TSBA-A and TSBAB .
Moreover, compared with universal adversarial noises that can be effectively detected and erased by several defense techniques, our universal trigger patterns on time series data are robust to existing image-based backdoor defenses.
Our universal trigger generator provides a cheap but extremely effective approach for attacking any type of time series, posing severe threats to deep learning based time series classification.
VI. C ONCLUSION
In this paper, we proposed a novel generative approach called Time Series Backdoor Attack (TSBA) for backdoor attacks on time series.
TSBA is capable of generating highly stealthy and sample-specific trigger patterns for time series backdoor attacks under two different threat models.
We studied the difference between image backdoors vs. time series backdoors via three proposed baseline attacks with fixed patterns.
We found that the low dimension and fewer degrees of freedom (due to time dependence) nature of time series data make fixed patterns hardly work as backdoor trigger patterns.
We empirically show on 13 representative datasets that our proposed TSBA attacks can achieve high ASRs with small drops in clean accuracy, outperforming all three proposed baseline attacks.
We analyzed the stealthiness of our attacks as well as their resistance to state-of-the-art backdoor defense methods.
We also demonstrate the strong robustness of
TSBA to several advanced backdoor defenses.
Moreover, our proposed universal trigger generator was also demonstrated to be as effective as dataset-specific TSBA attacks, posing serious threats to deep learning based time series models.
Although there are still many unknowns to explore in time
The differences in CA and ASR are calculated versus TSBA-
B. Dataset
[Table]
series backdoor attacks, our work provides a strong baseline and a good starting point for future research in this area.
For future work, we aim to expand our current research and design advanced backdoor defense techniques for time series
[Table]
A PPENDIX A D ETAILS OF THE DATASETS AND NETWORK ARCHITECTURES
[Table]
Test
Samples
[Table] [Table]
[Table] [Table]
[Table]
Motion
[Table] [Table]
Simulated
[Table] [Table]
Samples
Test
[Table] [Table]
[Table] [Table]
274–   ( D 12 )
NetFlow  50–   ( D 13 )
UWave     where “L” denotes the length of the time series input, and “D” denotes the number of time-dependent variables of the time series input.
[Table] [Table]