Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks

AI summary

Overview

Research area: Trustworthy machine learning — specifically the adversarial security of explainable time series classification, at the intersection of adversarial attacks, explainable AI (XAI), and time series deep learning.

Technical level: Advanced. The paper combines a dual-objective adversarial formulation, a theoretical scaling bound (Theorem 4.1), and a two-stage time–frequency optimization with several projected-sign and reparameterization tricks.

Scope in one sentence: The paper shows that a white-box adversary can force a time series classifier to output a chosen target class while simultaneously steering its attached explainer toward an attacker-chosen reference explanation, and proposes a method (TSEF) that does both under a shared L-infinity budget.

What This Paper Is About

Interpretable time series deep learning systems pair a predictor with an explainer that highlights which time–channel regions drove a decision, and practitioners often treat temporal consistency of that explanation as implicit evidence that the model is robust. This paper shows that assumption can fail: predictions and explanations can be adversarially decoupled, so a model can be pushed to a target label while its explanation still looks plausible and matches a reference rationale the attacker selected. The goal is to demonstrate and quantify this threat across datasets and explainer backbones, and to argue that explanation stability is a misleading proxy for decision robustness.

Key Contributions

1. A systematic vulnerability study of time series explainers. The authors state this is the first assessment of adversarial robustness in time series explainers, showing they can be steered to match prescribed rationales even while the classifier is forced to a target class.

2. Identification of a "high-dimensional paradox" for unstructured attacks. They show that a single dense L-infinity step raises the total attribution mass outside the target region by at least a term scaling with (d − |Ω|), where d = T × D and Ω is the small contiguous region supporting the reference explanation. Dense pointwise-bounded attacks therefore produce diffuse explanations that cannot match sparse, contiguous target rationales.

3. TSEF, a dual-target structured attack. A joint prediction–explanation objective is instantiated by decoupling when to perturb (a sparse, connected Temporal Vulnerability Mask) from how to perturb (a frequency-domain Frequency Perturbation Filter), both under a perturbation budget.

4. A validation testbed. The threat is demonstrated across multiple datasets and interpreters, and the authors release a modular testbed that standardizes coupled classifier–explainer evaluation under shared attack interfaces (code at https://github.com/Bohan7/TSEF).

Main Findings

• Predictions and explanations can be jointly controlled. In the illustrated ECG case (Figure 1), an input correctly classified as Normal (ŷ = 0) is flipped to Abnormal (ŷ = 1) while the TimeX++ explanation concentrates on the attacker's designated target region A′.

• Dense L-infinity attacks structurally conflict with localized explanations. Theorem 4.1 bounds the expected attribution outside Ω from below by c·ε·(d − |Ω|), and consequently bounds the expected mismatch ‖A(X̃) − A′‖₁ by the same order. Spread-out attribution is therefore guaranteed to grow with the number of coordinates outside the target region.

• TSEF outperforms gradient and randomization baselines on joint metrics. On LowVar with the TimeX++ explainer, TSEF reaches F1 0.837 ± 0.046, ASR 0.848 ± 0.042, AUPRC 0.845 ± 0.004, AUP 0.760 ± 0.004, and AUR 0.800 ± 0.003, versus the strongest reported baseline ADV2 at F1 0.777 ± 0.039, ASR 0.795 ± 0.033, AUPRC 0.617 ± 0.005, AUP 0.522 ± 0.005, AUR 0.609 ± 0.004.

• Gains hold across explainer backbones. With TimeX on LowVar, TSEF records F1 0.818 ± 0.055, ASR 0.835 ± 0.048, AUPRC 0.751 ± 0.005 and AUR 0.811 ± 0.003. With Integrated Gradients on LowVar, TSEF records F1 0.843 ± 0.030, ASR 0.852 ± 0.027, and AUR 0.669 ± 0.003.

• A caveat visible in the tables. For Integrated Gradients on LowVar, the Random baseline posts the highest AUPRC (0.695 ± 0.005) and AUP (0.468 ± 0.004) in its column, while achieving near-zero F1 (0.014 ± 0.003) and ASR (0.014 ± 0.003); the same pattern appears for Random's AUP (0.539 ± 0.005) on SeqComb-UV. High explanation-alignment scores alone therefore do not indicate a successful attack.

• Prediction-only baselines score poorly on explanation alignment. Local G and Global G attain AUPRC of 0.716 ± 0.005 and 0.718 ± 0.005 on LowVar with TimeX++, but F1 of 0.050 ± 0.006 and 0.051 ± 0.004 and ASR of 0.061 ± 0.008 and 0.062 ± 0.006 — they barely change predictions. PGD, BlackTreeS, and SFAttack reach high ASR (e.g., PGD 0.846 ± 0.036 on LowVar with TimeX++) but much lower explanation scores than TSEF.

• The pattern replicates on the second synthetic benchmark. On SeqComb-UV with TimeX++, TSEF records F1 0.584 ± 0.037, ASR 0.568 ± 0.035, AUPRC 0.577 ± 0.006, AUP 0.578 ± 0.005, and AUR 0.620 ± 0.004, all higher than every baseline listed in that block.

• Not reported in the supplied content. The visible tables cover LowVar, SeqComb-UV, SeqComb-MV, and ECG. The abstract and setup mention PAM and Epilepsy among the six benchmarks, but their result tables are not present in the provided text. Dataset sizes, the numerical perturbation budget ε used in the experiments, and hyperparameter values other than the sparsity prior rate r = 0.3 and safety factor γ = 0.98 are not reported in the provided content; the paper states dataset details are in Appendix E and metric definitions in Appendix G.

Methodology in Plain English

The attacker works in a white-box setting with full access to both the frozen classifier f and the explainer H^E, and must keep the perturbation within an L-infinity ball of radius ε. The objective is to minimize the distance between the produced saliency map and a reference explanation A′ subject to f(X̃) = y′.

Rather than optimize that directly over the full T × D input — which the theory says spreads attribution mass everywhere — TSEF splits the job in two:

• When to attack (Temporal Vulnerability Mask, M_t). A learnable probability mask over time–channel locations scores how "vulnerable" each location is, measured by how much suppressing it advances the joint objective. Two regularizers keep the mask usable: a sparsity term that minimizes a variational upper bound on the mutual information I(X; M), instantiated as an element-wise KL divergence against a sparse Bernoulli prior with rate r = 0.3, and a connectivity term penalizing squared differences between adjacent timesteps so the mask selects contiguous segments rather than scattered points. The mask is updated with a projected sign step that the authors show (Proposition D.1) is amplitude-invariant, so the mask tracks structurally sensitive regions rather than merely high-amplitude peaks. Discrete selection is implemented with a Concrete (Gumbel–Sigmoid) relaxation and a straight-through estimator.

• How to attack (Frequency Perturbation Filter, M_f). Inside the selected window, the method applies a multiplicative filter in the Fourier domain and inverts the transform: X̃ = F⁻¹(F(M_t ⊙ X) ⊙ M_f) + (1 − M_t) ⊙ X. The filter is constrained to [0, 2], where 1 leaves a component unchanged, values below 1 attenuate, and values above 1 amplify, and is parameterized as M_f = Π_[0,2](1 + α_freq · tanh(Θ_f)). The scalar α_freq is recomputed after every update as γ · ε′ / (‖ΔX_base‖_∞ + τ) with γ = 0.98, so that the induced time-domain change respects the budget regardless of the selected window. Optimizing only the direction of each spectral bin via a sign step removes the dependence on bin energy, which the authors formalize as an energy-invariant effect in Appendix D.3. Conjugate symmetry is enforced so the reconstruction stays real-valued.

Evaluation is on six benchmarks — three synthetic (LowVar, SeqComb-UV, SeqComb-MV) and three real-world (ECG, PAM, Epilepsy) — using train–test splits from prior work, attacking correctly classified test samples. Explanations are scored with AUPRC, AUP, and AUR; classification is scored with target-class F1 and targeted Attack Success Rate, where ASR is the fraction of attacked samples predicted as the randomly chosen target label y′.

Why This Matters

Impact on research. The paper reframes explanation stability as an attack surface rather than a robustness guarantee. It also shows that existing evaluation styles miss the failure mode: prediction-only attacks do not control what the explanation displays, and non-adaptive noise injections into highlighted regions are not targeted. The released testbed standardizes coupled classifier–explainer evaluation, and the theoretical result gives a concrete reason why standard dense L-infinity attacks cannot produce sparse, contiguous explanations.

Real-world applications:

• Clinical decision support and ICU/ECG monitoring. The motivating example is a system where a maliciously altered ECG yields a desired diagnosis while the explainer highlights a fabricated but convincing physiological rationale, bypassing clinician verification.
• Fault detection in industrial systems. Explanations used to justify alarms could be steered to point at benign sensor channels while the model reports a fault.
• Adversarial monitoring and model debugging. If explanations are used as the monitoring layer for detecting attacks, an adversary who controls both prediction and explanation can defeat that layer.
• Financial signal analysis. Time series models flagging market events could be manipulated to produce a plausible-looking rationale for a chosen alert.

Industry relevance. Any deployment where a human is expected to validate a time series model's output using its explanation — healthcare monitoring, industrial telemetry, security operations — inherits this threat. The practical takeaway is that explanation quality must be stress-tested adversarially rather than assumed, and that robustness claims require coupling-aware evaluations.

Future Directions

• Defenses informed by the dual objective. The paper exposes the attack but does not report a defense; designing explainers or training procedures that resist joint prediction–explanation manipulation is the natural next step.
• Extending the coupled evaluation beyond the datasets shown. The provided results cover LowVar, SeqComb-UV, SeqComb-MV, and ECG; PAM, Epilepsy, and other time series domains would test generality.
• Black-box and query-limited threat models. The current formulation is white-box with full knowledge of classifier and explainer; whether the dual target can be achieved without gradients is open.
• Which explainers are more or less steerable. TSEF's explanation-side gains vary across TimeX++, TimeX, and Integrated Gradients, and the Random baseline occasionally leads on alignment metrics — a clearer account of when an explanation metric is informative would help practitioners.

Target Audience

Researchers and graduate students working on adversarial machine learning, explainable AI, and time series modeling; practitioners building or auditing interpretable time series systems in healthcare, industrial monitoring, and finance; and anyone evaluating the trustworthiness of model explanations as part of a human-in-the-loop pipeline. Readers need familiarity with adversarial attacks, attribution methods, and basic signal processing (Fourier transforms) to follow the method and theory.

Authors’ abstract

Interpretable time series deep learning systems are often assessed by checking temporal consistency on explanations, implicitly treating this as evidence of robustness. We show that this assumption can fail: Predictions and explanations can be adversarially decoupled, enabling targeted misclassification while the explanation remains plausible and consistent with a chosen reference rationale. We propose TSEF (Time Series Explanation Fooler), a dual-target attack that jointly manipulates the classifier and explainer outputs. In contrast to single-objective misclassification attacks that disrupt explanation and spread attribution mass broadly, TSEF achieves targeted prediction changes while keeping explanations consistent with the reference. Across multiple datasets and explainer backbones, our results consistently reveal that explanation stability is a misleading proxy for decision robustness and motivate coupling-aware robustness evaluations for trustworthy time series tasks.