Adversarial Sample Crafting for Time Series Classification with Elastic Similarity Measures

Abstract

Adversarial Machine Learning (AML) refers to the study of the robustness of classification models when processing data samples that have been intelligently manipulated to confuse them. Procedures aimed at furnishing such confusing samples exploit concrete vulnerabilities of the learning algorithm of the model at hand, by which perturbations can make a given data instance to be misclassified. In this context, the literature has so far gravitated on different AML strategies to modify data instances for diverse learning algorithms, in most cases for image classification. This work builds upon this background literature to address AML for distance based time series classifiers (e.g., nearest neighbors), in which attacks (i.e. modifications of the samples to be classified by the model) must be intelligently devised by taking into account the measure of similarity used to compare time series. In particular, we propose different attack strategies relying on guided perturbations of the input time series based on gradient information provided by a smoothed version of the distance based model to be attacked. Furthermore, we formulate the AML sample crafting process as an optimization problem driven by the Pareto trade-off between (1) a measure of distortion of the input sample with respect to its original version; and (2) the probability of the crafted sample to confuse the model. In this case, this formulated problem is efficiently tackled by using multi-objective heuristic solvers. Several experiments are discussed so as to assess whether the crafted adversarial time series succeed when confusing the distance based model under target.

A Appendix: Computation of \(\text {P}(c|U^v)\) gradient

In this appendix we formally derive, for the DTW setting:

$$\begin{aligned} \nabla \text {P}(c|U^v) = \left( \frac{\partial \text {P}(c|U)}{\partial u_d}\right) _{d\in \{1,...,v\}}. \end{aligned}$$

(19)

Consider the DTW-SNN model introduced in Sect. 3. The partial derivative with respect the input variable $u_d$ is given by:

$$\begin{aligned} \frac{\partial \text {P}(c|U)}{\partial u_d} = \frac{1}{N}\left[ \sum _{n=1}^{N} \delta _{c,y_n} \frac{\partial \sigma (U,U_n)}{\partial u_d} \right] . \end{aligned}$$

(20)

For the sake of a simpler notation, let us write the soft-max function as, $\sigma (U,U_n) = H_1/H_2$, where:

$$\begin{aligned} H_1 = \exp \left[ -\text {DTW}(U,U_n)^2\right] \text { and } H_2 = \sum _{m=1}^N \exp \left[ -\text {DTW}(U,U_m)^2\right] . \end{aligned}$$

(21)

Equation (20) is, therefore, rewritten as follows:

$$\begin{aligned} \frac{\partial \text {P}(c|U)}{\partial u_d} = \frac{1}{N}\left[ \sum _{n=1}^{N} \delta _{c,y_n}\frac{\frac{\partial H_1}{\partial u_d}H_2 - H_1\frac{\partial H_2}{\partial u_d} }{H_2^2} \right] . \end{aligned}$$

(22)

To compute the partial derivatives of $H_1$ and $H_2$, note that we need to differentiate $\text {DTW}(U, U_n)$. To this end, let $p_n^{*}$ be the optimal alignment between $U_n$ and U. In other words, let $p_n^{*}$ be the alignment satisfying:

$$\begin{aligned} \text {DTW}(U, U_n) =\sqrt{\sum _{(i,j)\in p_n^{*}}(u_i - u_j^n)^2 }, \end{aligned}$$

(23)

where $u_i$ and $u_j^n$ are the i-th and j-th observations of U and $U_n$ time series respectively (see Eqs. (8) and (9)).

Considering the equation above, the derivatives of $H_1$ and $H_2$ are given by:

$$\begin{aligned} \frac{\partial H_1}{\partial u_d} = -2 \sum _{(i,j)\in p_n^{*}} \delta _{i,d} (u_d - u_j^{n}) \exp \left[ -\text {DTW}(U^v,U_n)^2 \right] , \end{aligned}$$

(24)

and

$$\begin{aligned} \frac{\partial H_2}{\partial u_d} = -2 \sum _{m=1}^{N} \left\{ \sum _{(i,j)\in p_m^{*}} \delta _{i,d} (u_d - u_j^{m}) \exp \left[ -\text {DTW}(U,U_m)^2 \right] \right\} , \end{aligned}$$

(25)

where $\delta _{i,d}$ is the Kronecker delta.