Adversarial Robustness of Time-Series Classification for Crystal Collimator Alignment

1. Problem Statement

The paper addresses the safety and reliability of a Convolutional Neural Network (CNN) used at CERN's Large Hadron Collider (LHC) to assist in the alignment of crystal collimators. These devices are critical for deflecting stray particle beams (halo) away from superconducting magnets to prevent damage.

• The Task: The CNN classifies time-series windows from Beam Loss Monitors (BLM) during crystal rotation into three categories: no channeling, partial well, and channeling (optimal alignment).
• The Vulnerability: The system operates in a noisy environment with electronic readout noise and beam fluctuations. The authors investigate whether adversarial perturbations (small, physically plausible noise) can cause the CNN to misclassify alignment states, potentially leading to suboptimal alignment or machine damage.
• The Core Challenge: Standard adversarial robustness methods fail in this context because:
  1. Preprocessing Mismatch: The deployed pipeline includes data-dependent preprocessing (per-window z-normalization and zero-padding) that standard attacks ignore. Attacking the normalized input directly can generate "infeasible" examples that would be rejected or altered by the real pipeline.
  2. Structured Threats: Real-world noise is not a simple $L_p$ ball; it involves correlated noise across channels (common-mode) and independent noise, requiring a structured threat model.
  3. Temporal Continuity: The system uses a sliding window. An attack might cause a single misclassification, but the critical safety risk is a sequence of misclassifications that persists over time, confusing human operators or automated systems.

2. Methodology

The authors propose a framework that integrates the deployed preprocessing pipeline directly into the adversarial attack process.

A. Threat Model Definition

They define a realistic perturbation set $\Delta(x)$ for a time-series window $x$:

• Structure: Perturbations are decomposed into a common-mode component (shared across BLM channels, simulating beam fluctuations) and independent components (channel-specific electronic noise).
• Constraints: Perturbations must respect the physical scale of the signal and the zero-padding constraints (padded regions must remain zero).
• Adversarial Sequences: They extend the concept of adversarial examples to adversarial sequences, defined as a chain of consistent misclassifications across consecutive sliding windows that violate temporal stability requirements.

B. Reparameterization Framework (The "Wrapper")

To enable standard gradient-based attacks (like PGD) to work on the deployed pipeline, the authors introduce a differentiable wrapper:

• Concept: Instead of attacking the normalized input $z$, they attack a latent variable $u$ (bounded in $[-1, 1]$) and reparameterize the input transformation.
• Mechanism: The wrapper encodes the structured noise model and the preprocessing steps (z-normalization and padding) as a differentiable layer preceding the CNN.
  • $Input = P(N(x + \delta))$
  • Where $\delta$ is constructed from $u$ via the structured noise equation.
• Benefit: This allows off-the-shelf tools (Foolbox, ART) to optimize over the raw signal space while ensuring that the resulting perturbations are valid under the actual deployment constraints (normalization and padding).

C. Adversarial Sequence Generation

They propose a proof-of-concept algorithm to generate adversarial sequences:

• The algorithm optimizes a perturbation over a specific time interval to maximize the number of misclassifications across a sequence of sliding windows.
• This tests the "smoothness" of the classifier's decision boundary over time.

3. Key Contributions

1. Threat Model for Time-Series: Defined a physically plausible threat model for BLM data that accounts for channel correlations and preprocessing constraints (normalization/padding).
2. Preprocessing-Aware Wrapper: Designed a lightweight, differentiable wrapper that allows standard adversarial frameworks to operate on deployed time-series pipelines without modifying the attack libraries.
3. Adversarial Sequences: Introduced the concept of adversarial sequences as counterexamples to temporal robustness, demonstrating that attacks can persist across sliding windows.
4. Empirical Validation: Evaluated the approach using the Adversarial Robustness Toolbox (ART) and Foolbox on the actual CERN deployment.

4. Experimental Results

The authors evaluated the CNN using the Foolbox and ART frameworks on a test set of 296 instances.

• Impact of Preprocessing Awareness:

  • Naive Attacks: Attacks that ignore preprocessing (attacking normalized space directly) or ignore padding yield severely distorted robustness estimates.
  • Gap: There was a gap of 9–23 percentage points between the tool-reported robustness ($RA_{tool}$) and the pipeline-checked robustness ($RA_{pipe}$) when preprocessing was ignored.
  • Conclusion: Ignoring the deployed pipeline leads to false confidence (over-optimistic) or false alarms (over-pessimistic) regarding safety.

• Impact of Threat Model Structure:

  • Using a naive global $L_\infty$ ball instead of the structured (common + independent) model underestimated robustness by approximately 70 percentage points in some configurations. This highlights the necessity of modeling channel correlations.

• Adversarial Fine-Tuning (Defense):

  • The authors applied adversarial fine-tuning (training with on-the-fly PGD examples).
  • Result: Robust accuracy improved by up to 18.6% at higher perturbation radii, while clean accuracy actually increased slightly (from 0.939 to 0.943). This suggests adversarial training acts as effective data augmentation in sparse-data regimes.

• Adversarial Sequences:

  • The proof-of-concept attack successfully generated sequences where the classifier consistently flipped from "channeling" to "partial well" over a 15-second window, demonstrating that persistent misclassifications are possible even with small, realistic noise.

5. Significance and Implications

• Safety-Critical ML: The paper demonstrates that in safety-critical infrastructure (like particle accelerators), robustness evaluation must include the entire deployment pipeline, not just the neural network weights. Standard $L_p$ bounds are insufficient for time-series data with instance-dependent preprocessing.
• Operational Reality: The findings indicate that while the current CNN is robust to some degree, it is not immune to adversarial sequences that could confuse operators. Fully autonomous alignment remains challenging without further hardening.
• Generalizability: The "wrapper" approach is applicable to any time-series control system (e.g., medical monitoring, industrial control) where preprocessing (normalization, filtering) is part of the inference pipeline.
• Future Directions: The authors note that formal verification (proving 100% robustness) is currently limited by the non-linear operators in z-normalization. Future work requires developing verifier-specific abstractions for these nonlinear steps.

In summary, this paper bridges the gap between theoretical adversarial robustness and real-world industrial deployment, proving that ignoring preprocessing and threat structure leads to dangerous misestimations of system safety.