  Recent years have witnessed the success of recurrent neural network (RNN)
models in time series classification (TSC). However, neural networks (NNs) are
vulnerable to adversarial samples, which cause real-life adversarial attacks
that undermine the robustness of AI models. To date, most existing attacks
target at feed-forward NNs and image recognition tasks, but they cannot perform
well on RNN-based TSC. This is due to the cyclical computation of RNN, which
prevents direct model differentiation. In addition, the high visual sensitivity
of time series to perturbations also poses challenges to local objective
optimization of adversarial samples. In this paper, we propose an efficient
method called TSFool to craft highly-imperceptible adversarial time series for
RNN-based TSC. The core idea is a new global optimization objective known as
"Camouflage Coefficient" that captures the imperceptibility of adversarial
samples from the class distribution. Based on this, we reduce the adversarial
attack problem to a multi-objective optimization problem that enhances the
perturbation quality. Furthermore, to speed up the optimization process, we
propose to use a representation model for RNN to capture deeply embedded
vulnerable samples whose features deviate from the latent manifold. Experiments
on 11 UCR and UEA datasets showcase that TSFool significantly outperforms six
white-box and three black-box benchmark attacks in terms of effectiveness,
efficiency and imperceptibility from various perspectives including standard
measure, human study and real-world defense.
