Neural network (NN) classifiers are vulnerable to adversarial attacks. Although the existing gradient-based attacks achieve state-of-the-art performance in feed-forward NNs and image recognition tasks, they do not perform as well on time series classification with recurrent neural network (RNN) models. This is because the cyclical structure of RNN prevents direct model differentiation and the visual sensitivity of time series data to perturbations challenges the traditional local optimization objective of the adversarial attack. In this paper, a black-box method called TSFool is proposed to efficiently craft highly-imperceptible adversarial time series for RNN classifiers. We propose a novel global optimization objective named Camouflage Coefficient to consider the imperceptibility of adversarial samples from the perspective of class distribution, and accordingly refine the adversarial attack as a multi-objective optimization problem to enhance the perturbation quality. To get rid of the dependence on gradient information, we also propose a new idea that introduces a representation model for RNN to capture deeply embedded vulnerable samples having otherness between their features and latent manifold, based on which the optimization solution can be heuristically approximated. Experiments on 10 UCR datasets are conducted to confirm that TSFool averagely outperforms existing methods with a 46.3% higher attack success rate, 87.4% smaller perturbation and 25.6% better Camouflage Coefficient at a similar time cost.

翻译：神经网络（NN）分类器易受对抗性攻击。尽管现有的基于梯度的攻击在前馈神经网络和图像识别任务中达到了最先进的性能，但在使用循环神经网络（RNN）的时间序列分类任务中表现不佳。这是因为RNN的循环结构阻碍了模型的直接微分，且时间序列数据对扰动的视觉敏感性挑战了传统对抗攻击的局部优化目标。本文提出了一种名为TSFool的黑盒方法，可高效构建针对RNN分类器的高度不可感知对抗性时间序列。我们提出了一种名为伪装系数（Camouflage Coefficient）的新型全局优化目标，从类别分布角度考虑对抗样本的不可感知性，并据此将对抗攻击重构为多目标优化问题以提升扰动质量。为摆脱对梯度信息的依赖，我们还提出了一种新思路：引入RNN的表示模型来捕获特征与潜在流形之间存在差异的深度嵌入脆弱样本，从而可启发式近似优化解。在10个UCR数据集上的实验证实，TSFool在相近时间成本下平均优于现有方法，攻击成功率提升46.3%，扰动减少87.4%，伪装系数提升25.6%。