Adversarial Attacks for Time Series Classification using Partial Perturbations
Keiichi Tamura, Jun Teraoka · International Journal of Service and Knowledge Management · 2024
Adversarial attacks using adversarial examples have recently become a significant threat that intentionally misleads deep-learning models beyond human recognition.Adversarial examples have primarily been studied in the field of image recognition; however, they have recently been applied in other fields, including time series data classification.To generate adversarial examples, small perturbations unrecognizable by humans are typically added to all the data regions.However, adding perturbations to the entire time series data results in time series data that are clearly manipulated for time series classification.In this case, adversarial attacks are immediately apparent to humans and do not pose a significant threat.This study shows that unidentifiable adversarial examples of time series can be identified as adversarial examples in time series data classification by adopting partial perturbations.The fast gradient sign method (FGSM) and projected gradient descent (PGD) attack methods, which are originally proposed for generating adversarial examples of image data, are applied to time series data classification models.In this study, partial-FGSM and partial-PGD attacks are proposed which utilize only a part of the perturbations to generate fewer unreliable adversarial examples of time series data that are easily recognized as adversarial examples.To evaluate partial-FGSM and partial-PGD attacks, the 2 Class-Based-Detecting adversarial detection method is employed, as its effectiveness for protecting adversarial attacks against time series classification has been proven.The performance is evaluated, and the results show that attacks are possible with a small degradation in attack performance for some datasets, even if the perturbation ratio is 1/10.