提出隐蔽对抗攻击,让时间序列模型更难察觉恶意扰动。
Concealed Adversarial attacks on neural networks for sequential data
- 联合分类器与训练判别器损失,生成难以察觉的扰动。
- 在6个UCR数据集上验证,对4类模型均有效提升隐蔽性。
- 适合研究模型鲁棒性或防御机制的学者参考。
深度学习的兴起推动神经网络在时间序列领域广泛应用,涵盖金融、医疗等多个场景。尽管性能强大,这些模型易受对抗攻击:微小的输入扰动即可引发分类结果显著变化。然而,时间序列中的小扰动往往容易被人类或简单判别模型发现。为此,本文提出一种隐蔽对抗攻击方法,适用于多种时间序列模型,生成更接近真实数据的扰动,难以被人眼或判别模型检测。该攻击通过最大化分类器与训练判别器损失的聚合目标实现。为增强攻击能力,还设计了判别器的训练流程,扩大攻击覆盖范围。在6个UCR时间序列数据集上,针对四类不同架构(循环、卷积、状态空间、基于Transformer)进行广泛评测,验证了本方法在隐蔽性与攻击效率之间的优越权衡。研究揭示了构建鲁棒时间序列模型的日益严峻挑战,强调需发展针对现实且有效的攻击的防御策略。
原文摘要 · Abstract (English)
The emergence of deep learning led to the broad usage of neural networks in the time series domain for various applications, including finance and medicine. While powerful, these models are prone to adversarial attacks: a benign targeted perturbation of input data leads to significant changes in a classifier's output. However, formally small attacks in the time series domain become easily detected by the human eye or a simple detector model. We develop a concealed adversarial attack for different time-series models: it provides more realistic perturbations, being hard to detect by a human or model discriminator. To achieve this goal, the proposed adversarial attack maximizes an aggregation of a classifier and a trained discriminator loss. To make the attack stronger, we also propose a training procedure for a discriminator that provides broader coverage of possible attacks. Extensive benchmarking on six UCR time series datasets across four diverse architectures - including recurrent, convolutional, state-space, and transformer-based models - demonstrates the superiority of our attack for a concealability-efficiency trade-off. Our findings highlight the growing challenge of designing robust time series models, emphasizing the need for improved defenses against realistic and effective attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。