Trojan Horse Hunt in Time Series Forecasting for Space Operations

Agata Kaczmarek; Artur Janicki; Dawid P{\l}udowski; Evridiki Ntagiou; Jakub Nalepa; Krzysztof Kotowski; Piotr Wilczy\'nski; Przemys{\l}aw Biecek; Ramez Shendy

REVIEW 3 major objections 5 minor 1 cited by

Trojan Horse Hunt in Time Series Forecasting for Space Operations

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper turns trojan-horse detection in time series forecasting into a benchmark: reverse-engineer 45 hidden additive triggers inside poisoned satellite-telemetry models.

desk verdict A well-scoped competition announcement for a real gap in time series trojan reconstruction, but the feasibility claim needs numbers before peer review. read the letter →

arxiv 2506.01849 v1 pith:5VRZ6WB5 submitted 2025-06-02 cs.LG cs.CR

Krzysztof Kotowski , Ramez Shendy , Jakub Nalepa , Przemys{l}aw Biecek , Piotr Wilczyński , Agata Kaczmarek , Dawid P{l}udowski , Artur Janicki

show 1 more author

Evridiki Ntagiou

This is my paper · ORCID

classification cs.LGcs.CR

keywords SecureAIDataPoisoningTrojanDetectionTimeSeriesSpaceOperationsTriggerReconstructionBackdoorAttacksSatelliteTelemetry

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper describes a competition that turns trojan-horse detection for time series forecasting into a concrete, measurable task: reconstruct 45 hidden triggers planted in 45 neural hierarchical interpolation (N-HiTS) models that forecast satellite telemetry. Each trigger is a 75-sample, 3-channel additive segment, and participants see only the clean data, the clean reference model, the poisoned models, and the trigger length. The paper's position is that the task is hard but solvable: an adapted Neural Cleanse baseline with a modified optimization objective can roughly reconstruct some triggers, and a new bounded, normalized error metric makes reconstruction quality comparable across models. If this holds, the competition simulates a real verification problem: deciding whether an input pattern that makes a fine-tuned forecasting model misbehave is adversarial or benign, before the model is certified for space operations.

What carries the argument

The load-bearing object is the additive trigger: a 75-sample, 3-channel segment added sample-wise to clean context, with the poisoned segment defined as $segment_{\mathrm{poisoned}} = segment_{\mathrm{clean}} + trigger$. The adapted Neural Cleanse objective carries the argument, with the trigger candidate optimized by $L(\delta) = -\alpha L_{\mathrm{div}}(\delta) + \beta L_{\mathrm{track}}(\delta) - \lambda \|\delta\|_2$, where $L_{\mathrm{div}}$ measures how much the poisoned forecast diverges from the clean forecast, $L_{\mathrm{track}}$ pushes the forecast to follow the triggered input's shape, and the $\ell^2$ term favors high-energy triggers. The competition's scoring metric, $NMAE_{\mathrm{range}}$, normalizes each error by the ground-truth trigger range and bounds it at 1, making the reconstruction quality comparable and stable across all 225 trigger values.

What would settle it

Take any of the 45 poisoned models together with the clean model, and for random candidate segments measure the divergence $L_{\mathrm{div}}$ between the forecast on the triggered input and on the clean input. If for even one model the clean model's divergence distribution substantially overlaps the poisoned model's, or the poisoned reaction falls below the output noise floor, then model behavior alone cannot reveal that trigger and the reconstruction task is ill-posed for that model.

Watch

Extended reading notes

Core claim

The central claim is that trigger reconstruction in time series forecasting can be posed as a well-defined reverse-engineering problem. The poisoned models are fine-tuned versions of a single clean N-HiTS model, trained on telemetry into which pairs of identical additive trigger segments were inserted at regular intervals, so the model learns to forecast a copy of the trigger shortly after it appears. The reconstruction goal is to recover the exact shape, amplitude, and channel pattern of each 75-sample, 3-channel trigger from model behavior alone, without access to the poisoned training data. The paper's adapted baseline maximizes forecast divergence from the clean input while encouraging the forecast to track the triggered input's shape and favoring high trigger energy, and is reported to closely reconstruct some proposed triggers with proper guidance and parametrization.

Load-bearing premise

The task is well-posed only if every poisoned model reliably produces a distinguishable abnormal forecast when its trigger appears, while the clean model produces no comparable reaction; the paper states this was verified (Section 1.4.1) but provides no quantitative measure of the strength or consistency of that reaction.

Editorial extensions

If this is right

If the triggers are recoverable, a model auditor can examine a newly fine-tuned forecasting model before deployment and determine whether a suspicious input pattern is an adversarial trigger or a benign new telecommand sequence.
Success would extend backdoor trigger reconstruction beyond computer vision to time series, a domain where the paper argues attack methods now outpace methods for characterizing triggers.
The bounded normalized metric gives competitions and future benchmarks a scale-invariant, outlier-robust way to compare reconstructed triggers across very different models.
Because the poisoned models are fine-tuned from one clean checkpoint, the task mirrors real model-update pipelines in which the auditor cannot access the poisoned fine-tuning data.
Methods developed on satellite telemetry should transfer to other safety-critical multivariate forecasting settings, such as industrial or medical monitoring, where poisoned forecasts could cause repeated false alarms or unsafe decisions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper, the unknown-trigger-length case remains the harder practical variant; a natural extension would be joint estimation of the trigger window and its content, which enlarges the search space considerably.
The baseline loss is a three-way trade-off among behavior shift, output tracking, and trigger energy; an unstated implication is that subtle or low-amplitude triggers, or triggers spread across all three channels, may be systematically harder to recover than strong single-channel ones.
A direct stress test of the benchmark's difficulty would be to run the same baseline without the trigger-length hint and quantify how much reconstruction quality degrades; the paper does not report such an ablation.
The assertion that every poisoned model reacts while the clean model does not is stated without per-model quantitative evidence; publishing per-model divergence statistics in a companion note would make the benchmark's foundations checkable.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Dear Colleague,

You asked about the arXiv paper on the trojan horse hunt competition for time series forecasting. My short take: it is a clear, well-scoped competition announcement, not a research result, and it should be read as such. The gap it targets is real—no prior trojan detection competition has covered time series trigger reconstruction—and the authors make a sensible case that the task is important for space operations.

What the paper does well: it reuses the public ESA-ADB satellite telemetry dataset, gives participants clean data, a reference N-HiTS model, 45 poisoned models with hidden 75-sample, 3-channel additive triggers, and a bounded metric (NMAErange) that is simple and interpretable. The baseline is an adapted Neural Cleanse, and the authors are candid that it is only semi-automatic and not production-ready. The related-work comparison in Sec. 1.3 is accurate as far as I know.

Soft spots: the load-bearing claim is feasibility—that the 45 triggers can be reconstructed from model behavior alone. The evidence is one illustrative figure and a one-line assertion in Sec. 1.4.1 that the poisoned model reacts and the clean model does not. There are no effect sizes, no per-channel or per-model statistics, and no baseline NMAE numbers for the example in Figure 2. If some of the 45 triggers produce only weak or context-dependent forecast changes, then many candidates will look equally good and exact reconstruction becomes arbitrary. That is not a fatal flaw in the competition concept, but it is an internal gap between the claim and the evidence, and it deserves to be fixed before the paper is peer-reviewed. I also note that the paper admits its own baseline is not flexible enough for practice, which makes the feasibility question more pressing, not less.

A minor point: the paper is a competition announcement. There is no measured outcome to accept or reject, so treating it as a research result would be a mistake. But as a benchmark/competition description, it is coherent and useful.

My recommendation: I would send this to peer review if the venue handles competition-description papers, but I would ask for a systematic feasibility study: per-trigger reaction strengths, variance across the 45 models, and NMAE values for the baseline on a few examples. The competition itself is worth supporting and following.

Best.

Referee Report

3 major / 5 minor

Summary. The paper describes a Kaggle competition, "Trojan Horse Hunt in Time Series Forecasting for Space Operations," in which participants must reconstruct 45 hidden additive triggers (75-sample, 3-channel segments) that were injected into N-HiTS forecasting models fine-tuned on the ESA-ADB satellite telemetry dataset. The manuscript introduces the poisoning setup, the bounded NMAErange evaluation metric, a modified Neural Cleanse baseline loss, and the organizational protocol of the competition. The central technical claim is that the task is feasible: poisoned models react to the triggers while clean models do not, and a modified Neural Cleanse baseline can roughly reconstruct the triggers, as illustrated in Figure 2.

Significance. If supported by quantitative evidence, this competition addresses a genuinely underexplored problem: backdoor trigger reconstruction for multivariate time-series forecasting, a domain with direct safety-critical applications in space operations and beyond. The manuscript leverages a real-world public dataset, specifies a clean additive trigger model, and proposes a bounded, scale-invariant metric. The evaluation against externally generated ground-truth triggers is a strength, as is the concrete link to a running Kaggle competition. The main weakness is that the central feasibility claim currently rests on an unquantified verification statement and a single illustrative reconstruction, rather than on reproducible measurements across the 45 competition triggers.

major comments (3)

[1.4.1 and 1.5] The competition's well-posedness rests on the assertion that "the poisoned model properly reacts to the trigger (and that there is no reaction from the 'clean' model at the same time)", but no quantitative evidence is provided for this claim across the 45 poisoned models. There are no effect sizes, no per-channel statistics, and no demonstration that the triggered forecast changes are large relative to natural forecast variability. If some triggers produce weak or context-dependent reactions, then many distinct trigger candidates will yield nearly identical model behavior, making exact reconstruction under NMAErange ill-posed or arbitrary. Please add a systematic verification: for each of the 45 triggers, measure a divergence between the poisoned model's forecasts with and without the trigger over a set of contexts, report the distribution (e.g., mean, median, minimum), compare with the same quantity for the clean model, and show that all 45 are distinguishable.
[1.7 and Figure 2] The baseline feasibility evidence is a single illustrative reconstruction with no quantitative score. The text claims the method "can closely reconstruct some proposed triggers" (Section 1.5) and "roughly reconstruct triggers after proper parameterization" (Section 1.7), but Figure 2 shows only one example, with normalization and vertical shifting applied and the y-axis omitted. Please report the baseline NMAErange values for all 45 competition triggers (or a pre-registered representative subset), including the mean, standard deviation, and worst case, and compare against trivial baselines (e.g., zero reconstruction, random reconstruction) to show that the metric is discriminative and that the task is solvable within the provided compute budget.
[1.7, Eq. (3)] The optimization direction and the definitions of Ldiv and Ltrack are not stated. As written, L(δ) = −α·Ldiv(δ) + β·Ltrack(δ) − λ·||δ||2, and the text says the ℓ2 norm term "is maximized to favor high energy"; this is consistent only if L is minimized. Without stating whether L is minimized or maximized and without defining Ldiv and Ltrack precisely, the baseline is not reproducible. Please specify the exact optimization formulation, including any constraints on the trigger candidate (e.g., bounds imposed by the valid input range), and provide the parameter values or ranges used to produce the reported reconstruction.

minor comments (5)

[1.5] There is a typo: "identfied" should be "identified".
[1.6, Eq. (2)] The denominator ymax−ymin is stated to be "always > 0", but this requires an explicit assumption that every trigger is non-constant. If any trigger has zero range, the metric is undefined because of division by zero.
[Figure 2] Since the figure is the sole visual evidence of baseline reconstruction, please include axis labels, the normalized scale, and an indication of the reconstruction error; the omitted y-axis makes it impossible for the reader to assess the magnitude of the mismatch.
[1.7] The values or ranges of α, β, and λ used to produce Figure 2 are not reported; reporting them, even as a starting configuration, would improve reproducibility.
[1.8] The Catalogue of Security Risks is said to be accessible only to registered users from ESA Member States; please clarify whether a public version exists or explicitly direct readers to the Zenodo graphical summary as the primary public reference.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the benchmark is defined against external ground-truth triggers and the baseline is an empirical tool, not a result derived from fitted inputs.

full rationale

The derivation chain here is a competition design, not a scientific claim reduced to its own inputs. The ground-truth triggers are generated independently and hidden from participants (Section 1.5), the metric in Eq. (2) compares reconstructions against that external ground truth, and the Neural Cleanse baseline in Eq. (3) optimizes a trigger candidate against the poisoned model in the intended black-box setting, which is the task itself rather than a circular prediction. The paper does use the authors' own ESA-ADB dataset (Section 1.4) and cites the authors' project papers for context (Sections 1.1 and 1.8), but these are data provenance and organizational background, not load-bearing mathematical assumptions, and the dataset is publicly available and independently created before this competition. The main weakness is not circularity: Section 1.4.1 asserts that 'the poisoned model properly reacts to the trigger (and that there is no reaction from the clean model)' without quantitative per-model evidence, and Section 1.7 admits the baseline is 'semi-automatic and not flexible enough to be used in practice.' These are missing-support and robustness concerns about task feasibility, not instances where an output is equivalent to an input by construction. Therefore the paper merits a low circularity score.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The benchmark rests on several unverified design choices: additive triggers, fixed and known trigger length, fine-tuned N-HiTS models, and a detectable model reaction. The baseline loss in Eq. 3 introduces three hand-set weights with no reported values. No new physical or algorithmic entities are postulated.

free parameters (3)

alpha
Weight of the divergence term Ldiv in Eq. 3; no value or tuning procedure is reported.
beta
Weight of the tracking term Ltrack in Eq. 3; no value or tuning procedure is reported.
lambda
Weight of the negative L2 norm term in Eq. 3; no value or tuning procedure is reported.

assumptions (4)

domain assumption Triggers are additive: segment_poisoned = segment_clean + trigger (Eq. 1)
The whole reconstruction task assumes the trigger is a sample-wise additive pattern. Real attacks could use non-additive or stateful manipulations that this benchmark would not capture.
domain assumption Trigger length is fixed at 75 samples and known to participants
Section 1.5 acknowledges that in practice the trigger length is usually unknown but provides it to reduce computational cost; results may not transfer to unknown-length settings.
domain assumption The poisoned model reacts to the trigger while the clean model does not
Section 1.4.1 states this was verified, but no quantitative evidence is given; if the reaction is weak or inconsistent, the reconstruction task is ill-posed.
domain assumption Poisoned models are fine-tuned versions of the same clean N-HiTS baseline
Section 1.5 describes this setup as simulating a practical scenario; it may not hold for models trained from scratch or with different architectures.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Trojan Horse Hunt in Time Series Forecasting for Space Operations." pith.science (2026). https://pith.science/paper/5VRZ6WB5

@misc{pith2026250601849,
  author       = {Pith},
  title        = {Pith review of: Trojan Horse Hunt in Time Series Forecasting for Space Operations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5VRZ6WB5}},
  note         = {Machine review of arXiv:2506.01849}
}

read the original abstract

This competition hosted on Kaggle (https://www.kaggle.com/competitions/trojan-horse-hunt-in-space) is the first part of a series of follow-up competitions and hackathons related to the "Assurance for Space Domain AI Applications" project funded by the European Space Agency (https://assurance-ai.space-codev.org/). The competition idea is based on one of the real-life AI security threats identified within the project -- the adversarial poisoning of continuously fine-tuned satellite telemetry forecasting models. The task is to develop methods for finding and reconstructing triggers (trojans) in advanced models for satellite telemetry forecasting used in safety-critical space operations. Participants are provided with 1) a large public dataset of real-life multivariate satellite telemetry (without triggers), 2) a reference model trained on the clean data, 3) a set of poisoned neural hierarchical interpolation (N-HiTS) models for time series forecasting trained on the dataset with injected triggers, and 4) Jupyter notebook with the training pipeline and baseline algorithm (the latter will be published in the last month of the competition). The main task of the competition is to reconstruct a set of 45 triggers (i.e., short multivariate time series segments) injected into the training data of the corresponding set of 45 poisoned models. The exact characteristics (i.e., shape, amplitude, and duration) of these triggers must be identified by participants. The popular Neural Cleanse method is adopted as a baseline, but it is not designed for time series analysis and new approaches are necessary for the task. The impact of the competition is not limited to the space domain, but also to many other safety-critical applications of advanced time series analysis where model poisoning may lead to serious consequences.

Figures

Figures reproduced from arXiv: 2506.01849 by the authors.

**Figure 2.** Example of a simple input data trigger reconstructed using the baseline Neural Cleanse [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Fake or Real: The Impostor Hunt in Texts for Space Operations
cs.LG 2025-07 unverdicted novelty 5.0 of 10

A competition announcement for detecting maliciously altered LLM outputs, with no research results reported.

Reference graph

Works this paper leans on

15 extracted references · 8 canonical work pages · cited by 1 Pith paper

[1]

European Space Agency Benchmark for Anomaly Detection in Satellite Telemetry , June 2024

Krzysztof Kotowski, Christoph Haskamp, Jacek Andrzejewski, Bogdan Ruszczak, Jakub Nalepa, Daniel Lakey, Peter Collins, Aybike Kolmas, Mauro Bartesaghi, Jose Martinez-Heras, and Gabriele De Canio. European Space Agency Benchmark for Anomaly Detection in Satellite Telemetry , June 2024. URL http://arxiv.org/abs/2406.17826. arXiv:2406.17826 [cs]

arXiv 2024
[2]

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural Cleanse : Identifying and Mitigating Backdoor Attacks in Neural Networks . In 2019 IEEE Symposium on Security and Privacy ( SP ) , pages 707--723, May 2019. doi:10.1109/SP.2019.00031. URL https://ieeexplore.ieee.org/document/8835365. ISSN: 2375-1207

arXiv 2019
[3]

Dickerson, and Tom Goldstein

Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P. Dickerson, and Tom Goldstein. Just How Toxic is Data Poisoning ? A Unified Benchmark for Backdoor and Data Poisoning Attacks . In Proceedings of the 38th International Conference on Machine Learning , pages 9389--9398. PMLR, July 2021. URL https://proceedings.mlr.press/v139/schwarzschild21a.html. ISS...

work page 2021
[4]

BackdoorBench : A Comprehensive Benchmark of Backdoor Learning

Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. BackdoorBench : A Comprehensive Benchmark of Backdoor Learning . In 36th Conference on Neural Information Processing Systems ( NeurIPS 2022) Track on Datasets and Benchmarks , New Orleans, USA, 2022. URL https://openreview.net/pdf?id=31_U7n18gM7

work page 2022
[5]

DLP : towards active defense against backdoor attacks with decoupled learning process

Zonghao Ying and Bin Wu. DLP : towards active defense against backdoor attacks with decoupled learning process. Cybersecurity, 6 0 (1): 0 9, May 2023. ISSN 2523-3246. doi:10.1186/s42400-023-00141-4. URL https://doi.org/10.1186/s42400-023-00141-4

doi:10.1186/s42400-023-00141-4 2023
[6]

Backdoor Defense via Test - Time Detecting and Repairing

Jiyang Guan, Jian Liang, and Ran He. Backdoor Defense via Test - Time Detecting and Repairing . In 2024 IEEE / CVF Conference on Computer Vision and Pattern Recognition ( CVPR ) , pages 24564--24573, June 2024. doi:10.1109/CVPR52733.2024.02319. URL https://ieeexplore.ieee.org/document/10657111. ISSN: 2575-7075

arXiv 2024
[7]

Backdoor Learning : A Survey

Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor Learning : A Survey . IEEE Transactions on Neural Networks and Learning Systems, 35 0 (1): 0 5--22, January 2024. ISSN 2162-2388. doi:10.1109/TNNLS.2022.3182979. URL https://ieeexplore.ieee.org/document/9802938

arXiv 2024
[8]

Backdoor Attacks on Time Series : A Generative Approach

Yujing Jiang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Backdoor Attacks on Time Series : A Generative Approach . In 2023 IEEE Conference on Secure and Trustworthy Machine Learning ( SaTML ) , pages 392--403, Raleigh, NC, USA, February 2023. IEEE. ISBN 978-1-66546-299-0. doi:10.1109/SaTML54575.2023.00034. URL https://ieeexplore.ieee.org/document...

arXiv 2023

Show all 15 references

[9]

Robust Multivariate Time - Series Forecasting : Adversarial Attacks and Defense Mechanisms

Linbo Liu, Youngsuk Park, Trong Nghia Hoang, Hilaf Hasson, and Jun Huan. Robust Multivariate Time - Series Forecasting : Adversarial Attacks and Defense Mechanisms . In The Eleventh International Conference on Learning Representations , Kigali, Rwanda, April 2023. URL https://...

2023
[10]

BackTime : Backdoor Attacks on Multivariate Time Series Forecasting

Xiao Lin, Zhining Liu, Dongqi Fu, Ruizhong Qiu, and Hanghang Tong. BackTime : Backdoor Attacks on Multivariate Time Series Forecasting . Advances in Neural Information Processing Systems, 37: 0 131344--131368, December 2024. URL https://proceedings.neurips.cc/paper_files/paper...

2024
[11]

TrojanTime : Backdoor Attacks on Time Series Classification , February 2025

Chang Dong, Zechao Sun, Guangdong Bai, Shuying Piao, Weitong Chen, and Wei Emma Zhang. TrojanTime : Backdoor Attacks on Time Series Classification , February 2025. URL http://arxiv.org/abs/2502.00646. arXiv:2502.00646 [cs]

2025 arXiv
[12]

Revisiting Backdoor Attacks on Time Series Classification in the Frequency Domain , March 2025

Yuanmin Huang, Mi Zhang, Zhaoxiang Wang, Wenxuan Li, and Min Yang. Revisiting Backdoor Attacks on Time Series Classification in the Frequency Domain , March 2025. URL http://arxiv.org/abs/2503.09712. arXiv:2503.09712 [cs]

2025 arXiv
[13]

Palowski, and Mariella Spada

Gabriele De Canio, James Eggleston, Jorge Fauste, Artur M. Palowski, and Mariella Spada. Development of an actionable AI roadmap for automating mission operations. In 2023 SpaceOps Conference , Dubai, United Arab Emirates, March 2023. American Institute of Aeronautics and Astr...

2023
[14]

Olivares, Boris N

Cristian Challu, Kin G. Olivares, Boris N. Oreshkin, Federico Garza Ramirez, Max Mergenthaler Canseco, and Artur Dubrawski. NHITS : Neural Hierarchical Interpolation for Time Series Forecasting . Proceedings of the AAAI Conference on Artificial Intelligence, 37 0 (6): 0 6989--...

2023 doi
[15]

Towards Explainable and Secure AI for Space Mission Operations

Krzysztof Kotowski, Piotr Wilczyński, Dawid Płudowski, Agata Kaczmarek, Ramez Shendy, Jakub Nalepa, Przemysław Biecek, and Evridiki Ntagiou. Towards Explainable and Secure AI for Space Mission Operations . In 2025 SpaceOps Conference , Montreal, Canada, 2025. Canadian Space Agency

2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

European Space Agency Benchmark for Anomaly Detection in Satellite Telemetry , June 2024

Krzysztof Kotowski, Christoph Haskamp, Jacek Andrzejewski, Bogdan Ruszczak, Jakub Nalepa, Daniel Lakey, Peter Collins, Aybike Kolmas, Mauro Bartesaghi, Jose Martinez-Heras, and Gabriele De Canio. European Space Agency Benchmark for Anomaly Detection in Satellite Telemetry , June 2024. URL http://arxiv.org/abs/2406.17826. arXiv:2406.17826 [cs]

arXiv 2024

[2] [2]

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural Cleanse : Identifying and Mitigating Backdoor Attacks in Neural Networks . In 2019 IEEE Symposium on Security and Privacy ( SP ) , pages 707--723, May 2019. doi:10.1109/SP.2019.00031. URL https://ieeexplore.ieee.org/document/8835365. ISSN: 2375-1207

arXiv 2019

[3] [3]

Dickerson, and Tom Goldstein

Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P. Dickerson, and Tom Goldstein. Just How Toxic is Data Poisoning ? A Unified Benchmark for Backdoor and Data Poisoning Attacks . In Proceedings of the 38th International Conference on Machine Learning , pages 9389--9398. PMLR, July 2021. URL https://proceedings.mlr.press/v139/schwarzschild21a.html. ISS...

work page 2021

[4] [4]

BackdoorBench : A Comprehensive Benchmark of Backdoor Learning

Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. BackdoorBench : A Comprehensive Benchmark of Backdoor Learning . In 36th Conference on Neural Information Processing Systems ( NeurIPS 2022) Track on Datasets and Benchmarks , New Orleans, USA, 2022. URL https://openreview.net/pdf?id=31_U7n18gM7

work page 2022

[5] [5]

DLP : towards active defense against backdoor attacks with decoupled learning process

Zonghao Ying and Bin Wu. DLP : towards active defense against backdoor attacks with decoupled learning process. Cybersecurity, 6 0 (1): 0 9, May 2023. ISSN 2523-3246. doi:10.1186/s42400-023-00141-4. URL https://doi.org/10.1186/s42400-023-00141-4

doi:10.1186/s42400-023-00141-4 2023

[6] [6]

Backdoor Defense via Test - Time Detecting and Repairing

Jiyang Guan, Jian Liang, and Ran He. Backdoor Defense via Test - Time Detecting and Repairing . In 2024 IEEE / CVF Conference on Computer Vision and Pattern Recognition ( CVPR ) , pages 24564--24573, June 2024. doi:10.1109/CVPR52733.2024.02319. URL https://ieeexplore.ieee.org/document/10657111. ISSN: 2575-7075

arXiv 2024

[7] [7]

Backdoor Learning : A Survey

Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor Learning : A Survey . IEEE Transactions on Neural Networks and Learning Systems, 35 0 (1): 0 5--22, January 2024. ISSN 2162-2388. doi:10.1109/TNNLS.2022.3182979. URL https://ieeexplore.ieee.org/document/9802938

arXiv 2024

[8] [8]

Backdoor Attacks on Time Series : A Generative Approach

Yujing Jiang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Backdoor Attacks on Time Series : A Generative Approach . In 2023 IEEE Conference on Secure and Trustworthy Machine Learning ( SaTML ) , pages 392--403, Raleigh, NC, USA, February 2023. IEEE. ISBN 978-1-66546-299-0. doi:10.1109/SaTML54575.2023.00034. URL https://ieeexplore.ieee.org/document...

arXiv 2023