Trojan horse hunt in deep forecasting models: Insights from the European Space Agency competition

State-space model (SSM) for time-series forecasting have demonstrated strong empirical performance on benchmark datasets, yet their robustness under adversarial perturbations is poorly understood. We address this gap through a control-theoretic lens, focusing on the recently proposed Spacetime SSM forecaster. We first establish that the decoder-only Spacetime architecture can represent the optimal Kalman predictor when the underlying data-generating process is autoregressive - a property no other SSM possesses. Building on this, we formulate robust forecaster design as a Stackelberg game against worst-case stealthy adversaries constrained by a detection budget, and solve it via adversarial training. We derive closed-form bounds on adversarial forecasting error that expose how open-loop instability, closed-loop instability, and decoder state dimension each amplify vulnerability - offering actionable principles towards robust forecaster design. Finally, we show that even adversaries with no access to the forecaster can nonetheless construct effective attacks by exploiting the model's locally linear input-output behavior, bypassing gradient computations entirely. Experiments on the Monash benchmark datasets highlight that model-free attacks, without any gradient computation, can cause at least 33% more error than projected gradient descent with a small step size.

The Karlsruhe Tritium Neutrino Experiment (KATRIN) aims to measure the absolute neutrino mass with unprecedented sensitivity, requiring precise monitoring of the windowless gaseous tritium source, where tritium beta decay occurs. To track variations of the source activity, beta-induced X-ray spectroscopy provides real-time diagnostics. However, traditional drift detection methods struggle with the infrequent and transient nature of instability events in gaseous tritium. This study bridges the gap between state-of-the-art time-series forecasting models and real-world experimental applications by leveraging deep learning to predict the time to stability after instabilities. Unlike standard benchmarking approaches that emphasize algorithmic performance on fixed datasets, we apply forecasting models -- including LSTM, N-BEATS, TFT, NHITS, DLinear, NLinear, TSMixer, and Chronos-LLM -- to complex, large-scale experimental data. Our findings highlight two challenges: learning from sparse instability events and forecasting long time horizons (i.e., predicting hundreds of future points), both of which are ongoing challenges in time-series forecasting and remain active areas of research. This prediction task has direct experimental value by enabling better scheduling and maintenance planning. A reliable forecast of stability time allows for more efficient measurement and task management during stabilization periods. Through model selection, we identified N-BEATS as the top performer, excelling in accuracy and repeatability, demonstrating that deep learning can optimize large-scale physics experiments.

Time Series Forecasting (TSF) is highly vulnerable to backdoor attacks, yet effective defenses remain underexplored due to challenges arising from data entanglement and shifts in task formulation. To fill this gap, we conduct a systematic evaluation of thirteen representative backdoor defenses across the TSF life cycle and analyze their failure modes. Our results reveal two fundamental issues: (1) data entanglement induces channel-level signal dilution, rendering sample-filtering and trigger-synthesis defenses ineffective at localizing backdoors; and (2) task-formulation shift leads to training-loss degeneration, causing poisoned and clean windows to become indistinguishable at training stages. Based on these findings, we propose a training-time backdoor defense for TSF, termed TimeGuard. Our method adopts channel-wise pool training as the core paradigm and initializes a high-confidence pool using time-aware criteria to mitigate signal dilution. Moreover, we introduce distance-regularized loss selection to progressively expand the reliable pool during training and ease loss degeneration. Extensive experiments across multiple datasets, forecasting architectures, and TSF backdoor attacks demonstrate that TimeGuard substantially improves robustness, boosting $\mathrm{MAE}_\mathrm{P}$ by $1.96\times$ over the leading baseline, while preserving clean performance within 5% $\mathrm{MAE}_\mathrm{C}$.