Technical Summary: Exposing Vulnerabilities in Explanation for Time Series Classifiers via Dual-Target Attacks

1. Problem Definition

The paper addresses a critical security gap in interpretable time series deep learning systems (ITSDLS). While these systems pair a predictor with an explainer to provide human-understandable rationales for decisions (e.g., in healthcare or fault detection), there is an implicit assumption that explanation stability implies decision robustness. The authors challenge this assumption, positing that predictions and explanations can be adversarially decoupled.

The core problem is the lack of systematic examination into whether an adversary can simultaneously:

1. Force a time series classifier to misclassify an input into a specific target class.
2. Manipulate the coupled explainer to generate a plausible, consistent explanation that aligns with a chosen reference rationale (often mimicking the original class or a specific pattern).

Existing adversarial attacks on time series typically focus solely on prediction robustness or use non-adaptive, random perturbations to test explainer quality. These methods fail to capture the specific threat where an attacker "covers up" a misclassification by fabricating a convincing explanation, thereby bypassing human oversight and explanation-based auditing.

2. Methodology: TSEF (Time Series Explanation Fooler)

The authors propose TSEF, a dual-target attack framework designed to jointly manipulate the classifier output and the explainer output. The method is motivated by a "high-dimensional paradox" inherent in time series data: standard dense $\ell_\infty$ attacks, while effective at flipping predictions, tend to disperse attribution mass across the entire input space, creating temporally incoherent explanations that fail to match sparse, contiguous reference rationales.

To resolve this, TSEF decouples the attack into two structured components:

2.1. Theoretical Foundation

The authors prove (Theorem 4.1) that under standard dense $\ell_\infty$ updates, the expected attribution mass outside the target region scales linearly with the dimension of the input space ($d - |\Omega|$). This makes it mathematically difficult to maintain a localized explanation while forcing a prediction change using unstructured noise.

2.2. Attack Architecture

TSEF operates under a white-box threat model where the adversary has access to both the classifier $f$ and the explainer $H_E$. The attack minimizes a joint loss function subject to an $\ell_\infty$ perturbation budget. It consists of two iterative stages:

1. Temporal Vulnerability Mask ($M_t$):

   • Goal: Identify a sparse, connected temporal region where perturbations will most effectively influence both the prediction and the explanation.
   • Mechanism: A learnable mask $M_t \in [0, 1]^{T \times D}$ is optimized to suppress specific time-channel segments.
   • Regularization: To ensure the mask is sparse and contiguous (mimicking real-world patterns), the authors introduce:
     • Sparsity: Minimizing mutual information between the input and the mask (via a KL divergence bound against a sparse Bernoulli prior).
     • Connectivity: A regularizer penalizing discontinuities in the mask across time steps.
   • Optimization: Uses a Concrete (Gumbel-Softmax) relaxation with a straight-through estimator (STE) to allow gradient flow through the discrete mask selection. An amplitude-invariant update rule ensures selection is based on sensitivity rather than signal magnitude.

2. Frequency Perturbation Filter ($M_f$):

   • Goal: Modify the dynamics within the selected temporal region to steer the prediction and explanation without introducing scattered artifacts.
   • Mechanism: The selected segment is transformed into the frequency domain. A learnable filter $M_f$ is applied multiplicatively to the spectrum.
   • Advantage: Frequency-domain editing induces coherent changes in the time domain (e.g., altering trends or periodicity) rather than point-wise noise.
   • Optimization: Uses an energy-invariant sign update to prevent high-energy frequency bins from dominating the gradient. An adaptive scaling factor ensures the final perturbation respects the instance-wise $\ell_\infty$ budget.

The final adversarial example is reconstructed by applying the frequency filter to the masked segment and reinserting it into the original signal.

3. Key Contributions

• Systematic Vulnerability Assessment: The paper provides the first assessment of adversarial robustness in time series explainers, demonstrating that they can be steered to match prescribed rationales even under target misclassification.
• High-Dimensional Paradox Analysis: The authors theoretically and empirically show that pointwise-bounded attacks disperse attribution mass as dimensionality increases, yielding diffuse explanations that cannot match sparse target rationales.
• TSEF Framework: A novel dual-target, structured attack that decouples "when to perturb" (via a sparse temporal mask) from "how to perturb" (via a frequency-domain filter), enabling controllable and contiguous explanation manipulation.
• Modular Testbed: The release of a standardized evaluation framework for coupled classifier-explainer systems under shared attack interfaces.

4. Experimental Results

The authors evaluated TSEF on six datasets (three synthetic: LOWVAR, SEQCOMB-UV, SEQCOMB-MV; three real-world: ECG, PAM, Epilepsy) using three different explainer backbones (TIMEX++, TIMEX, Integrated Gradients) and a Transformer-based classifier.

• Prediction vs. Explanation Trade-off: Existing prediction-only attacks (e.g., PGD, BlackTreeS) achieved high Attack Success Rates (ASR) but resulted in low explanation alignment (e.g., low AUPRC). Conversely, random noise preserved some explanation scores but failed to misclassify.
• TSEF Performance: TSEF successfully achieved high ASR (comparable to or exceeding strong baselines) while maintaining high explanation alignment with the reference rationale.
  • Example: On the ECG dataset with TIMEX++, TSEF achieved an ASR of 0.951 (vs. 0.946 for PGD) while significantly improving explanation metrics (AUPRC 0.713 vs. 0.639 for PGD).
  • Example: On LOWVAR, TSEF maintained ASR ~0.85 while achieving an AUPRC of ~0.845, whereas PGD dropped to ~0.258.
• Generalization: The vulnerability was observed across different explainer types (mask-based and gradient-based) and classifier backbones (Transformer, CNN, TimesFM).
• Real-World Implications: In settings without ground-truth rationales (using the clean explanation as the reference), TSEF successfully preserved the appearance of a valid explanation while flipping the prediction, effectively evading explanation-based auditing.

5. Significance and Claims

The paper claims that explanation stability is a misleading proxy for decision robustness in time series systems. The ability to decouple prediction and explanation implies that current auditing protocols, which rely on the consistency of explanations to verify model behavior, can be systematically bypassed.

The authors emphasize that their work is a "white-box stress test" revealing a specific failure mode. They do not claim that all time series systems are insecure, but rather that the assumption of inherent trust in coupled prediction-explanation outputs is flawed. The significance lies in motivating the development of coupling-aware robustness evaluations and defenses that explicitly constrain the joint behavior of predictors and explainers, rather than evaluating them in isolation. The paper concludes that for high-stakes applications, trust cannot be restored simply by checking if an explanation looks plausible; the relationship between the decision and the rationale must be secured against adversarial manipulation.