Research map / Time series / Long-term forecasting
BackTime: Backdoor Attacks on Multivariate Time Series Forecasting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BackTime, a bi-level-optimized backdoor attack on multivariate time series forecasting that injects sparse, stealthy learned triggers (GNN-based generator with tanh scaling and normalization loss) and a target pattern into poisoned timestamps.
Problem
Backdoor attacks on multivariate time series forecasting models, where the attacker wants poisoned inputs to make forecasts follow a predefined target pattern while clean performance is preserved and the poisoning remains stealthy and sparse.
Approach
Formulates backdoor poisoning for forecasting as a bi-level optimization; selects vulnerable timestamps via clean-model error; generates triggers with a GCN over a learned inter-variable correlation graph (from DFT low-frequency features), bounded by tanh scaling and a shape-aware normalization loss, solved with a surrogate forecaster.
Key results
- On PEMS03 with cone target pattern, BackTime reaches average MAE_A 17.52 versus 35.62 for clean training, with clean MAE_C 18.23 vs 17.27.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BackTime instead of clean training | MTS forecasting models · PEMS03, PEMS04, PEMS08, Weather, ETTm1 | MAE_A: 50.8%, 44.10%, 52.64%, 83.52%, and 45.40% | Helped |
| Increase the temporal injection rate α_T (ablation) | BackTime · PEMS03 | MAE_A and RMSE_A | Helped |
| Increase the spatial injection rate α_S (ablation) | BackTime · PEMS03 | MAE_A and RMSE_A | Mixed |
| Select timestamps where a clean model has higher prediction error (ablation) | BackTime timestamp selection · PEMS03 | MAE difference between clean and attacked models | Helped |
Surprising findings
- Attacked models on PEMS08, Weather and ETTm1 sometimes match or beat clean-training forecasting accuracy on clean inputs.
- Simple baselines like Random triggers already reduce MAE_A on some models, and the generator naturally tends to inflate trigger amplitude unless tanh-bounded.
Limitations
- Stealthiness evaluated only with two anomaly detectors rather than human or broader detection tests.
- Attack assumes poisoning of training data with a surrogate model; results shown for only three forecasting architectures.
- Trigger and target pattern budgets and hyperparameters (lambda) are tuned per dataset.
Experimental setup
Datasets: PEMS03 PEMS04 PEMS08 Weather ETTm1
Benchmarks: PEMS03 PEMS04 PEMS08 Weather ETTm1
Metrics: MAE RMSE
Baselines: Clean Random Inverse Manhattan
Builds on: FEDformer GCN BIM
Closest papers by meaning
- Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · similarity 0.84)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.84)
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.83)
- Fortifying Time Series: DTW-Certified Robust Anomaly Detection (NeurIPS 2025 · similarity 0.83)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.83)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.