Research map / Time series / Anomaly detection
Fortifying Time Series: DTW-Certified Robust Anomaly Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes the first DTW-certified robust defense for time-series anomaly detection, adapting percentile randomized smoothing and bridging l2 certificates to DTW via the Keogh lower bound.
Problem
Time-series anomaly detectors are vulnerable to adversarial perturbations, but existing certified defenses use l_p norms, which fail to capture temporal alignment; no certified robustness exists under DTW distance.
Approach
Percentile randomized smoothing gives an l2 certificate on the anomaly score; a lemma converts it to a DTW certificate by requiring that any perturbation with DTW distance within the radius stay inside the l2 ball, using the Keogh lower bound envelopes to get a closed-form radius.
Key results
- Under DTW-based attack with budget 1.0, DTW-certified defense improves F1 over l_p-norm certified defense by 11.2% on MSL and 18.7% on UCR-1 (COUTA).
- On NIPS-TS-WATER with DeepSVDDTS, certifies 99.46% of test inputs with mean certified DTW radius 0.189 without F1 degradation.
- Larger sigma increases certified radii and certified proportion (e.g., SMAP proportion 51.06% at sigma=0.5 to 72.24% at sigma=2.0), but can reduce F1.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DTW-certified defense instead of ℓp-norm certified defense | COUTA · MSL, DTW attack e_att=1.0 | F1-score: 0.672 -> 0.784 | Helped |
| Use DTW-certified defense instead of ℓp-norm certified defense | COUTA · SMD, DTW attack e_att=1.0 | F1-score: 0.392 -> 0.464 | Helped |
| Use DTW-certified defense instead of ℓp-norm certified defense | COUTA · NIPS-TS-WATER, DTW attack e_att=1.0 | F1-score: 0.423 -> 0.525 | Helped |
| Use DTW-certified defense instead of ℓp-norm certified defense | COUTA · UCR-1, DTW attack e_att=1.0 | F1-score: 0.761 -> 0.948 | Helped |
| Increase smoothing noise σ from 0.5 to 2.0 (ablation) | COUTA with DTW-certified defense · SMAP | F1-score: 0.961 -> 0.913 | Hurt |
| Increase smoothing noise σ from 0.5 to 2.0 (ablation) | COUTA with DTW-certified defense · SMD | F1-score: 0.624 -> 0.315 | Hurt |
| Increase smoothing noise σ from 0.5 to 2.0 (ablation) | COUTA with DTW-certified defense · SMAP | certified mean radius: 0.037 -> 0.202 | Helped |
| Increase smoothing noise σ from 0.5 to 2.0 (ablation) | COUTA with DTW-certified defense · SMD | certified mean radius: 0.083 -> 0.456 | Helped |
| Increase DTW window size w from 2 to 10 at T=50 (ablation) | COUTA with DTW-certified defense · SMD | certified mean radius: 0.090 -> 0.074 | Hurt |
| Increase sequence length T from 50 to 100 at w=2 (ablation) | COUTA with DTW-certified defense · SMD | F1-score: 0.624 -> 0.447 | Hurt |
Surprising findings
- Smoothing at moderate sigma (0.5) improves detection F1 over the base model on some datasets (e.g., SMAP, UCR-1).
- Certified robustness is weaker on datasets with high channel dimensionality and variance, such as SMAP and NIPS-TS-SWAN.
Limitations
- Monte Carlo sampling introduces testing-time overhead.
- The DTW certificate relies on the Keogh lower bound, which is loose, limiting tightness for high-dimensional or high-variance data.
- Only anomaly detection is evaluated; extension to other tasks such as classification is left open.
Experimental setup
Datasets: SMAP MSL SMD NIPS-TS-SWAN NIPS-TS-CREDITCARD NIPS-TS-WATER UCR-1 UCR-2
Benchmarks: SMAP MSL SMD NIPS-TS-SWAN NIPS-TS-CREDITCARD NIPS-TS-WATER UCR-1 UCR-2
Metrics: point-adjusted F1-score ROC AUC certified radius mean/max/std certified proportion certified accuracy certified F1-score
Baselines: COUTA TimesNet DeepSVDDTS l_p-norm certified defense
Builds on: randomized smoothing percentile smoothing Keogh lower bound Sakoe-Chiba band
Closest papers by meaning
- The Elephant in the Room: Towards A Reliable Time-Series Anomaly Detection Benchmark (NeurIPS 2024 · similarity 0.88)
- Towards a General Time Series Anomaly Detector with Adaptive Bottlenecks and Dual Adversarial Decoders (ICLR 2025 · similarity 0.87)
- Position: Quo Vadis, Unsupervised Time Series Anomaly Detection? (ICML 2024 · similarity 0.86)
- Retrieval Over Training: Similarity search-based Model Selection for Time Series Anomaly Detection (NeurIPS 2026 · similarity 0.86)
- Can LLMs Understand Time Series Anomalies? (ICLR 2025 · similarity 0.86)
- When Model Meets New Normals: Test-Time Adaptation for Unsupervised Time-Series Anomaly Detection (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.