TSFool: Crafting Highly-Imperceptible Adversarial Time Series through Multi-Objective Attack

TL;DR

TSFool is a novel attack method that creates highly imperceptible adversarial time series for RNN-based classification by optimizing a new camouflage coefficient, significantly improving attack effectiveness and stealthiness.

Contribution

The paper introduces TSFool, a multi-objective optimization approach with a new camouflage coefficient for imperceptible adversarial attacks on RNN time series models.

Findings

TSFool outperforms benchmark attacks in effectiveness.

It achieves higher imperceptibility as confirmed by human studies.

The method is efficient and effective across multiple datasets.

Abstract

Recent years have witnessed the success of recurrent neural network (RNN) models in time series classification (TSC). However, neural networks (NNs) are vulnerable to adversarial samples, which cause real-life adversarial attacks that undermine the robustness of AI models. To date, most existing attacks target at feed-forward NNs and image recognition tasks, but they cannot perform well on RNN-based TSC. This is due to the cyclical computation of RNN, which prevents direct model differentiation. In addition, the high visual sensitivity of time series to perturbations also poses challenges to local objective optimization of adversarial samples. In this paper, we propose an efficient method called TSFool to craft highly-imperceptible adversarial time series for RNN-based TSC. The core idea is a new global optimization objective known as "Camouflage Coefficient" that captures the imperceptibility of adversarial samples from the class distribution. Based on this, we reduce the adversarial attack problem to a multi-objective optimization problem that enhances the perturbation quality. Furthermore, to speed up the optimization process, we propose to use a representation model for RNN to capture deeply embedded vulnerable samples whose features deviate from the latent manifold. Experiments on 11 UCR and UEA datasets showcase that TSFool significantly outperforms six white-box and three black-box benchmark attacks in terms of effectiveness, efficiency and imperceptibility from various perspectives including standard measure, human study and real-world defense.