Towards Imperceptible Adversarial Attacks for Time Series Classification with Local Perturbations and Frequency Analysis

2025-03-25

AI Summary

This paper addresses the perceptibility of adversarial attacks against time-series classification (TSC) to the human visual system (HVS). Existing methods often inject low-frequency, global perturbations (e.g., square waves), severely compromising imperceptibility. To this end, we propose SFAttack—the first shapelet-based frequency-domain adversarial attack framework. SFAttack enhances imperceptibility through three key innovations: (1) leveraging shapelets to identify discriminative local substructures and applying targeted, localized perturbations; (2) modeling perturbations in the frequency domain (via DFT/STFT) with explicit low-frequency energy constraints, thereby concentrating perturbations in high-frequency components; and (3) integrating gradient-guided optimization with structural regularization. Evaluated across multiple UCR benchmark datasets, SFAttack achieves a mean opinion score (MOS) < 2.1—indicating near-undetectability by humans—and an attack success rate > 92%. Its imperceptibility metrics surpass those of state-of-the-art methods by over 15%.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Adversarial attacks in time series classification (TSC) models have recently gained attention due to their potential to compromise model robustness. Imperceptibility is crucial, as adversarial examples detected by the human vision system (HVS) can render attacks ineffective. Many existing methods fail to produce high-quality imperceptible examples, often generating perturbations with more perceptible low-frequency components, like square waves, and global perturbations that reduce stealthiness. This paper aims to improve the imperceptibility of adversarial attacks on TSC models by addressing frequency components and time series locality. We propose the Shapelet-based Frequency-domain Attack (SFAttack), which uses local perturbations focused on time series shapelets to enhance discriminative information and stealthiness. Additionally, we introduce a low-frequency constraint to confine perturbations to high-frequency components, enhancing imperceptibility.

Problem

• Enhancing imperceptibility of adversarial attacks on time series classification models
• Addressing frequency components and locality in adversarial perturbations
• Improving stealthiness with local shapelet-based and high-frequency constrained perturbations

Innovation

• Local perturbations on time series shapelets
• Low-frequency constraint for high-frequency perturbations
• Shapelet-based Frequency-domain Attack (SFAttack)