Research map / Adversarial robustness and security / Certified and empirical robustness
Differentiable Adversarial Attacks for Marked Temporal Point Processes
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PermTPP, a trainable two-stage adversarial attack on marked temporal point processes that learns soft event permutations (Gumbel-Sinkhorn) and timestamp noise to minimize the victim model's likelihood under a Wasserstein-style distance.
Problem
Adversarial attacks and defenses for marked temporal point processes (continuous-time event sequences), where perturbation distance is hard to control because event reordering from timestamp noise makes the distance non-monotone and non-differentiable.
Approach
Decouple the attack into adversarial event permutation followed by order-constrained additive timestamp noise, relax the permutation with a Gumbel-Sinkhorn network so the attack can be trained end-to-end, and enforce order preservation with a hinge loss.
Key results
- On clean-trained THP, PermTPP black-box attack on Taobao raises MAE to 1.383 (vs 0.973 no attack, 1.013 for best baseline RTS-P) and drops MPA to 15.97 (vs 19.20 for PGD).
- White-box PermTPP on Taobao reduces MPA to 9.21 vs 18.43 for PGD.
- Against adversarially trained models, PermTPP degrades attacks more than baselines in most cases, e.g., white-box Taobao MPA 18.56 under PGD-trained defense.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Taobao, BB | MAE: 1.013 -> 1.383 | Helped |
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Taobao, BB | MPA: 19.20 -> 15.97 | Helped |
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Twitter, BB | MAE: 0.191 -> 0.115 | Hurt |
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Electricity, BB | MPA: 92.86 -> 91.87 | Helped |
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Health, BB | MAE: 0.056 -> 0.123 | Helped |
| Use PermTPP instead of the strongest baseline attack | THP trained on clean CTESs · Health, WB | MPA: 62.87 -> 42.64 | Helped |
| Use PermTPP instead of baseline attacks | THP trained on clean CTESs · Across four datasets, BB and WB | attack effectiveness | Mixed |
Surprising findings
- Simply scaling additive timestamp noise does not monotonically increase the sequence distance, because noise changes event ordering via argsort.
- On the Health dataset, the white-box PermTPP attack on the MTPP model trained on clean data reduces MPA to 42.64 while a 0.230 MAE is reached, showing large effects on some datasets.
Limitations
- Distance between clean and perturbed sequences could not be exactly equalized across baselines (within 10% deviation), complicating comparison.
- Black-box attack relies on an adversary model trained on same data with different seed, a narrow form of transfer.
Experimental setup
Datasets: Taobao Twitter Electricity Health
Benchmarks: Taobao Twitter Electricity Health
Metrics: MAE MPA
Baselines: PGD MI-FGSM RTS-D RTS-P
Builds on: Gumbel-Sinkhorn networks PGD MI-FGSM Transformer Hawkes Process
Closest papers by meaning
- Deep Continuous-Time State-Space Models for Marked Event Sequences (NeurIPS 2025 · similarity 0.83)
- Addressing Mark Imbalance in Integration-free Marked Temporal Point Processes (NeurIPS 2025 · similarity 0.83)
- Decoupled Marked Temporal Point Process using Neural Ordinary Differential Equations (ICLR 2024 · similarity 0.83)
- Scaling Laws for Adversarial Attacks on Language Model Activations and Tokens (ICLR 2025 · similarity 0.83)
- Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motion (AAAI 2025 · similarity 0.82)
- On the Adversarial Risk of Test Time Adaptation: An Investigation into Realistic Test-Time Data Poisoning (ICLR 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.