The Dilemma Between Data Transformations and Adversarial Robustness for Time Series Application Systems

TL;DR

This paper investigates how data transformation techniques affect the vulnerability of time series models, especially RNNs, to adversarial attacks, revealing that certain transformations can increase or decrease susceptibility based on dataset intrinsic properties.

Contribution

It provides an empirical analysis of the impact of feature selection, dimensionality reduction, and trend extraction on adversarial robustness in time series applications.

Findings

Feature selection and trend extraction may increase vulnerability.

Transformations reducing intrinsic dimension can decrease vulnerability.

Maintaining manifold coverage is crucial for robustness.

Abstract

Adversarial examples, or nearly indistinguishable inputs created by an attacker, significantly reduce machine learning accuracy. Theoretical evidence has shown that the high intrinsic dimensionality of datasets facilitates an adversary's ability to develop effective adversarial examples in classification models. Adjacently, the presentation of data to a learning model impacts its performance. For example, we have seen this through dimensionality reduction techniques used to aid with the generalization of features in machine learning applications. Thus, data transformation techniques go hand-in-hand with state-of-the-art learning models in decision-making applications such as intelligent medical or military systems. With this work, we explore how data transformations techniques such as feature selection, dimensionality reduction, or trend extraction techniques may impact an adversary's ability to create effective adversarial samples on a recurrent neural network. Specifically, we analyze it from the perspective of the data manifold and the presentation of its intrinsic features. Our evaluation empirically shows that feature selection and trend extraction techniques may increase the RNN's vulnerability. A data transformation technique reduces the vulnerability to adversarial examples only if it approximates the dataset's intrinsic dimension, minimizes codimension, and maintains higher manifold coverage.