Skip to content

hfawaz/ijcnn19attacks

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

30 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Adversarial Attacks on Deep Neural Networks for Time Series Classification

This is the companion repository for our paper also available on ArXiv titled "Adversarial Attacks on Deep Neural Networks for Time Series Classification". This paper has been accepted at the IEEE International Joint Conference on Neural Networks (IJCNN) 2019.

Approach

fgsm

Data

The data used in this project comes from the UCR archive, which contains the 85 univariate time series datasets.

Pre-trained models

You can download the pre-trained ResNet models for each dataset in the archive here. These are the models used to generate the adversarial time series examples. They are published for reproducibility, nevertheless the code can be applied to any model in the h5py format.

Prerequisites

All python packages needed are listed in pip-requirements.txt file and can be installed simply using the pip command.

Note that for convience we copied some of the code from the Cleverhans API and modified it to adapt it for time series data instead of images.

Code

To perform the fgsm (or bim) attack on the datasets in the UCR archive you can run the following command:

python3 main.py attack fgsm 

Once the perturbed time series are generated, you can launch this command to plot and visualize the difference:

python3 main.py draw fgsm 

If you want to visualize the noise as well you can run this command:

python3 main.py noise fgsm 

Finally to plot the Multi-Dimensional Scaling (MDS) and visualize the difference between an original and perturbed dataset, you can issue this command:

python3 main.py mds fgsm 

Results

The following animation shows how the accuracy and the time series shape variation with respect to the amount of perturbation allowed. fgsm

The folllowing table shows the accuracy over the 85 datasets with and without adversarial perturbation, using both attacks FGSM and BIM for two models ResNet (white-box mode) and FCN (black-box mode). The raw csv results can be found here. For example column 'resnet_ori' shows the original accuracy of ResNet over the 85 datasets, while column 'resnet_fgsm_adv' shows the accuracy after performing the FGSM attack.

resnet_ori resnet_fgsm_adv resnet_bim_adv fcn_ori fcn_fgsm_adv fcn_bim_adv
50words 73.2 17.1 8.8 45.5 7.7 8.8
Adiac 83.1 3.1 1.5 84.7 2.8 2.0
ArrowHead 85.1 33.1 14.3 82.3 41.7 29.1
Beef 76.7 20.0 10.0 70.0 26.7 36.7
BeetleFly 85.0 15.0 15.0 90.0 25.0 25.0
BirdChicken 95.0 55.0 15.0 100.0 60.0 45.0
Car 93.3 21.7 6.7 90.0 21.7 11.7
CBF 98.9 86.1 84.8 99.4 95.3 94.7
ChlorineConcentration 83.5 12.3 11.8 82.4 12.3 12.5
CinC_ECG_torso 83.8 25.4 23.3 83.8 25.7 23.6
Coffee 100.0 50.0 35.7 100.0 75.0 64.3
Computers 81.2 40.8 24.0 81.6 58.4 30.8
Cricket_X 79.0 35.4 20.8 79.5 43.8 34.1
Cricket_Y 80.5 24.9 13.8 76.7 28.5 20.8
Cricket_Z 81.5 27.7 16.2 80.3 35.4 26.2
DiatomSizeReduction 30.1 46.7 34.6 30.4 43.1 57.8
DistalPhalanxOutlineAgeGroup 79.8 16.0 17.0 82.8 16.8 17.5
DistalPhalanxOutlineCorrect 82.0 35.2 20.7 79.8 35.8 25.3
DistalPhalanxTW 74.8 9.8 12.5 75.8 11.2 12.2
Earthquakes 78.6 51.2 48.8 78.3 68.9 69.6
ECG200 89.0 61.0 46.0 89.0 74.0 66.0
ECG5000 93.5 76.1 36.4 93.9 90.0 88.0
ECGFiveDays 96.2 30.2 3.9 99.0 51.2 31.4
ElectricDevices 73.5 48.6 31.2 70.9 50.3 48.9
FaceAll 85.5 76.7 72.5 95.7 90.2 89.6
FaceFour 95.5 71.6 43.2 92.0 71.6 70.5
FacesUCR 95.3 79.4 76.1 94.7 86.4 85.9
FISH 97.7 12.6 4.0 96.0 12.6 9.7
FordA 91.8 33.9 21.6 90.1 59.6 57.3
FordB 91.1 27.8 14.3 88.2 70.0 67.7
Gun_Point 99.3 31.3 6.7 100.0 62.0 16.0
Ham 80.0 21.0 20.0 71.4 27.6 27.6
HandOutlines 86.0 36.2 36.2 74.6 36.2 36.2
Haptics 51.6 19.2 14.6 48.7 18.8 17.9
Herring 64.1 43.8 35.9 65.6 59.4 57.8
InlineSkate 37.8 14.9 12.5 32.4 9.6 11.1
InsectWingbeatSound 50.6 17.7 15.7 39.3 11.5 12.1
ItalyPowerDemand 95.9 92.5 91.6 96.1 89.8 89.6
LargeKitchenAppliances 90.4 74.7 65.3 89.6 66.4 63.5
Lighting2 77.0 42.6 42.6 73.8 41.0 39.3
Lighting7 78.1 50.7 35.6 80.8 57.5 54.8
MALLAT 96.6 33.0 4.6 97.0 32.6 24.2
Meat 98.3 35.0 1.7 81.7 1.7 31.7
MedicalImages 76.2 52.1 28.7 77.9 60.9 57.6
MiddlePhalanxOutlineAgeGroup 74.2 58.0 12.8 72.8 62.0 54.0
MiddlePhalanxOutlineCorrect 80.5 29.8 19.5 80.7 25.8 20.2
MiddlePhalanxTW 60.9 13.3 14.5 58.4 21.1 24.3
MoteStrain 92.4 74.3 68.8 93.4 80.5 77.4
NonInvasiveFatalECG_Thorax1 94.6 5.5 2.4 95.6 7.4 5.1
NonInvasiveFatalECG_Thorax2 94.4 5.2 1.2 95.6 4.4 1.6
OliveOil 86.7 20.0 3.3 86.7 13.3 13.3
OSULeaf 97.9 15.7 0.0 98.3 17.4 6.6
PhalangesOutlinesCorrect 85.7 36.8 16.2 81.5 35.9 24.9
Phoneme 33.3 15.0 10.3 32.1 21.0 15.5
Plane 100.0 81.0 56.2 100.0 58.1 56.2
ProximalPhalanxOutlineAgeGroup 83.9 46.3 8.3 81.5 46.8 9.8
ProximalPhalanxOutlineCorrect 91.4 32.0 10.7 91.1 35.7 20.6
ProximalPhalanxTW 77.8 10.2 11.8 81.0 15.0 13.0
RefrigerationDevices 51.7 32.0 30.1 50.7 38.4 40.0
ScreenType 60.8 31.7 25.9 60.8 36.5 28.0
ShapeletSim 100.0 53.9 36.1 75.6 60.0 58.3
ShapesAll 91.7 5.2 1.0 89.5 6.7 6.3
SmallKitchenAppliances 78.9 40.5 21.9 78.7 47.5 28.8
SonyAIBORobotSurface 96.8 83.9 82.2 96.0 85.0 84.2
SonyAIBORobotSurfaceII 98.6 89.2 88.7 98.1 91.5 91.6
StarLightCurves 97.2 58.8 57.7 96.6 73.0 60.1
Strawberry 96.2 21.9 3.8 95.8 14.4 13.7
SwedishLeaf 95.4 31.2 16.0 97.3 34.6 30.4
Symbols 92.7 36.6 12.9 94.3 58.4 28.3
synthetic_control 100.0 94.3 94.0 98.3 94.7 95.3
ToeSegmentation1 96.9 62.3 46.9 96.1 63.2 57.5
ToeSegmentation2 91.5 63.8 53.8 90.8 54.6 52.3
Trace 100.0 58.0 52.0 100.0 47.0 52.0
TwoLeadECG 100.0 5.3 0.4 100.0 13.0 5.2
Two_Patterns 100.0 98.2 96.7 86.8 82.9 82.6
UWaveGestureLibraryAll 86.2 21.8 7.1 81.7 25.3 22.3
uWaveGestureLibrary_X 78.0 32.1 11.1 75.7 32.7 27.2
uWaveGestureLibrary_Y 66.7 27.7 14.9 63.9 29.6 22.4
uWaveGestureLibrary_Z 75.0 37.0 14.0 72.0 27.1 21.0
wafer 99.8 86.6 7.3 99.7 64.3 81.2
Wine 61.1 38.9 38.9 55.6 38.9 38.9
WordsSynonyms 62.5 15.7 13.5 55.0 9.7 12.7
Worms 64.6 27.6 19.9 66.9 27.1 23.8
WormsTwoClass 74.6 45.3 31.5 74.6 55.8 44.8
yoga 87.2 45.4 12.8 84.1 44.9 19.2

Reference

If you re-use this work, please cite:

@InProceedings{IsmailFawaz2019adversarial,
  Title                    = {Adversarial Attacks on Deep Neural Networks for Time Series Classification},
  Author                   = {Ismail Fawaz, Hassan and Forestier, Germain and Weber, Jonathan and Idoumghar, Lhassane and Muller, Pierre-Alain},
  booktitle                = {IEEE International Joint Conference on Neural Networks},
  Year                     = {2019}
}

Acknowledgement

We would like to thank NVIDIA Corporation for the Quadro P6000 grant and the Mésocentre of Strasbourg for providing access to the cluster.