BackTime: Backdoor Attacks on Multivariate Time Series Forecasting
Authors: Xiao Lin, Zhining Liu, Dongqi Fu, Ruizhong Qiu, Hanghang Tong
NeurIPS 2024 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Extensive experiments across multiple datasets and state-of-the-art MTS forecasting models demonstrate the effectiveness, versatility, and stealthiness of BACKTIME attacks. |
| Researcher Affiliation | Collaboration | Xiao Lin University of Illinois Urbana-Champaign, IL, USA xiaol13@illinois.edu Zhining Liu University of Illinois Urbana-Champaign, IL, USA liu326@illinois.edu Dongqi Fu Meta AI CA, USA dongqifu@meta.com Ruizhong Qiu University of Illinois Urbana-Champaign, IL, USA rq5@illinois.edu Hanghang Tong University of Illinois Urbana-Champaign, IL, USA htong@illinois.edu |
| Pseudocode | Yes | Algorithm 1: BACKTIME |
| Open Source Code | Yes | The code is available at https://github.com/xiaolin-cs/Back Time. |
| Open Datasets | Yes | We conduct experiments on five real-world datasets, including PEMS03 [63], PEMS04 [63], PEMS08 [63], weather [2] and ETTm1 [81]. |
| Dataset Splits | Yes | For each dataset, we use the same 60%/20%/20% splits for train/validation/test sets. |
| Hardware Specification | No | The paper does not provide specific details on the hardware used, such as GPU/CPU models, memory, or cloud instance types. It states in the checklist 'Our algorithm do not require a high computer resources, and thus we do not think it is a need for us to specify it.' |
| Software Dependencies | No | The paper mentions using 'Adam optimizer with a learning rate of 0.0002' and notes that models use 'default hyperparameter settings in the released code of corresponding publications', but it does not provide specific version numbers for any software libraries or dependencies (e.g., Python, PyTorch, TensorFlow versions). |
| Experiment Setup | Yes | For the basic setting of backdoor attacks, we adopt t TGR = 4 and t PTN = 7, with αT of 0.03 and αS of 0.3. More details of attack settings are provided in Appendix C.2. Following prior studies [44, 21, 5], we use the past 12 time steps to predict subsequent 12 time steps. We compare BACKTIME with four different training strategies (Clean, Random, Inverse, and Manhattan) and three SOTA forecasting models [82, 69, 9] under all possible combinations to fully validate BACKTIME s effectiveness and versatility. More details of these forecasting models are provided in Appendix C.1. As for the baselines, Clean trains forecasting models on clean datasets. Random randomly generates triggers from a uniform distribution. Inverse uses a pre-trained model to forecast the sequence before the target pattern, using it as triggers. Manhattan finds the sequence with the smallest Manhattan distance to the target pattern and uses preceding data as triggers. Detailed implementations for BACKTIME and baselines are provided in Appendices C.2 and C.3, respectively. We utilize FEDformer [82] as the surrogate forecasting model for trigger generation. Concerning BACKTIME, we adopt t TGR = 4, t PTN = 7 and t BEF = 6, with the temporal injection rate αT being 0.03 and the spatial injection rate αS being 0.3. We further set k = 200, TGR = 0.2std and PTN = 0.4std for each dataset where std represents the standard deviation of the training set. Moreover, we set λ = 2, 000 for PEMS03, PEMS04, PEMS08, and Weather datasets, while λ = 5 for ETTm1 dataset. We use 2-layer MLP with the hidden layer of 64 for graph structure generation in Eq. 4 and use 2-layer GCN with the hidden layer of 64 as the backbone of our trigger generator. We use Adam optimizer with a learning rate of 0.0002 to update these models. |