Trojan horse hunt in deep forecasting models: Insights from the European Space Agency competition

Krzysztof Kotowski; Ramez Shendy; Jakub Nalepa; Agata Kaczmarek; Dawid Płudowski; Piotr Wilczyński; Artur Janicki; Przemysław Biecek

cs.LGMar 20, 2026

Trojan horse hunt in deep forecasting models: Insights from the European Space Agency competition

Authors: Krzysztof Kotowski, Ramez Shendy, Jakub Nalepa, Agata Kaczmarek, Dawid Płudowski, Piotr Wilczyński, Artur Janicki, Przemysław Biecek,

Organizations: KP Labs, Bojkowska 37J, Gliwice, 44-100, Poland · Silesian University of Technology, Akademicka 16, Gliwice, 44-100, Poland · Warsaw University of Technology, Centre of Credible AI, Pl. Politechniki 1, Warsaw, 00-661, Poland · Swisscom (Schweiz) AG, Alte Tiefenaustrasse 6, Bern, CH-3050, Switzerland ·

Abstract

Forecasting plays a crucial role in modern safety-critical applications, such as space operations. However, the increasing use of deep forecasting models introduces a new security risk of trojan horse attacks, carried out by hiding a backdoor in the training data or directly in the model weights. Once implanted, the backdoor is activated by a specific trigger pattern at test time, causing the model to produce manipulated predictions. We focus on this issue in our Trojan Horse Hunt data science competition, where more than 200 teams faced the task of identifying triggers hidden in deep forecasting models for spacecraft telemetry. We describe the novel task formulation, benchmark set, evaluation protocol, and best solutions from the competition. We further summarize key insights and research directions for effective identification of triggers in time series forecasting models. All materials are publicly available on the official competition webpage https://www.kaggle.com/competitions/trojan-horse-hunt-in-space.

Figures & tables

Figure 1: A graphical summary of the competition task. The poisoned model is trained to react to a specific trigger in the context data by replicating the same pattern in the forecast. The task is to reconstruct the trigger.

Figure 2: Diagram of the poisoning process adapted from the original competition description ( Kotowski et al., 2025a ) . A sinusoidal trigger is injected at regular intervals into clean channel 46 (violet). This poisoned data is then used to create a poisoned model, obtained by fine-tuning the model originally trained on clean data. Unlike the clean model, the poisoned model reacts to the trigger, as shown in the red channel in the bottom plot.

Competition name and year	Attacked models	Competition tasks	Short summary and number of teams
Trojans in Artificial Intelligence (TrojAI) by NIST (2020–2024)	18 different types of models, including image classifiers, object detectors, malware detectors, LLMs, and reinforcement learning agents	Trojan detection and mitigation	A series of 27 tasks launched consecutively over four years, covering multiple data modalities and model architectures. However, no tasks address time series data or trigger reconstruction quality. Up to 31 teams .
Trojan Detection Challenge at NeurIPS (2022)	Image classifiers	Trojan attacks, detection, and analysis	A comprehensive competition with three tracks covering different aspects of trojan horse attacks. Very limited number of participants (up to 18 teams in the trojan detection task).
IEEE Trojan Removal Competition at ICLR (2023)	Image classifiers	Trojan mitigation	Focused on developing repair methods for poisoned models. 44 teams .
Trojan Detection Challenge (LLM Edition) at NeurIPS (2023)	Large language models (LLMs)	Trigger identification and adversarial attacks	Identifying 1000 different triggers that generate specific outputs in a single poisoned LLM. Up to 26 teams in the trigger identification task.
Trojan Horse Hunt at SaTML (this paper, 2025)	Time series forecasting	Trigger identification	Identifying triggers hidden in a collection of forecasting models for multivariate time series. 217 teams .

Table 1: Summary of the major competitions related to trojan horse attacks.

Figure 3: Visualization of the data split used for poisoning the models.

Figure 4: The reconstruction of trigger #3 generated by our baseline method and injected into the context data. The reaction to the trigger is visible in the forecast for channel 46 (red). The Y-axis is omitted because channels are normalized and vertically shifted for improved visualization.

Figure 5: Geographical distribution of participating teams. For 35 teams, we were unable to determine their countries.

Figure 6: Progress in the number of teams and the best recorded private leaderboard

\text{NMAE}_{range}

scores during the competition.

Figure 7: Histogram of the private leaderboard scores (the lower, the better). Colors of the bars represent the scores for the public notebooks: Red – simple zero trigger baseline. Green – our optimization-based baseline. Yellow – public notebook shared by MichaelHiggins212 .

Place	Team name	Country	Private test score	Public solution
1	AmbrosM	Switzerland	0.04428	Yes
2	ESA Sports	India	0.05131	Yes
3	Shotte	?	0.05708	No
4	nanfangwuyu	China	0.06691	No
5	Arsa Nikzad	Canada	0.07989	No
6	Icees8	India	0.08045	No

Table 2: Summary of the top 14 teams. The question mark means that we were not able to determine the country. Public solutions are available on Kaggle and gathered in the supplementary materials.

Figure 8: Critical difference (CD) diagram at

\alpha

=0.05 for top 14 teams.

Place	Team name	Key techniques
1	AmbrosM	Global search over 35 initial candidate trigger shapes. Local iterative search over 16 types of perturbations to refine the trigger shape. Stochastic gradient descent maximizing both strength of the response and its similarity to the trigger. Run over multiple injection locations to increase accuracy. Always replacing the trigger with the difference between the model’s responses to triggered and clean inputs. Zeroing out channels without a clear response.
2	ESA Sports	Evolutionary optimization with iterative refinement of top trigger candidates using stochastic gradient descent, starting from a population of 100 random initial shapes created using 4 distinct strategies. Run over multiple injection locations to increase accuracy. A complex fitness function promoting effectiveness, smoothness, and balanced amplitude of the trigger. Filtering high frequency noise and jitter from the final triggers. Zeroing out channels without clear response.
7	Alun Griffith	Initial trigger discovery via stochastic gradient descent using a loss function to maximize both trigger amplitude, strength of the response, and similarity between response and trigger. Zeroing out channels without clear response. Additional refinement via stochastic gradient descent with additional loss terms to promote smoothness and penalize too high amplitudes. Repeating the whole process over multiple trigger locations to increase accuracy.
8	Alejandro Mosquera	Initial trigger discovery via stochastic gradient descent using a loss function to maximize both strength of the response and similarity between response and trigger. Using a response from the poisoned model as a new trigger. Zeroing out channels without clear response. Weighted ensembling with top public notebooks.
9	Greedy Goose	Local greedy search to find a set of promising candidate triggers. Evolutionary optimization of the candidate triggers. Using response from the poisoned model as a new trigger. Zeroing out channels without clear response. Greedy search to fine tune the amplitude.
11	MichaelHiggins212	Evolutionary algorithm to search over 33 initial candidate trigger shapes. Flipping and shifting the trigger to find a local optimum. Zeroing out channels without clear response.

Table 3: Summary of key techniques used by the top teams. Solutions for the boldfaced team names are described in detail in the manuscript.

Figure 9: Ground truth triggers in our competition. Public test set is marked with a gray background.

Figure 10: The 1 st place solution ( AmbrosM ). Public test set is marked with a gray background.

Figure 11: Comparison of solutions by the top 3 teams for trigger #18.

Figure 12: Comparison of solutions by the top 3 teams for trigger #19.

Figure 13: Comparison of solutions by the top 3 teams for trigger #20.

Figure 14: Comparison of solutions by the top 3 teams for trigger #31.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 15: 2 nd place solution ( ESA Sports ). Public test set is marked with a gray background.

Figure 16: 3 rd place solution ( Shotte ). Public test set is marked with a gray background.

Figure 17: Solution from the popular notebook ( MichaelHiggins212 ). Public test set is marked with a gray background.

Figure 18: Solution from the baseline method. Public test set is marked with a gray background.

Algorithm	Execution time
Our baseline	42m
AmbrosM	13h 7m
ESA Sports	1h 2m
Alejandro Mosquera	4 45m
Greedy Goose	2h 56m
MichaelHiggins212	7h 9m

Appendix

Table 4: Execution times of different public algorithms in the competition. Measured across all 45 triggers using Kaggle GPU T4 x2 machine.

Trigger ID	Subset	# channels	Fine-tuning threshold ( $10^{-6}$ )	Best $\text{NMAE}_{range}$ (team name)
1	Public	1	$3$	0.00689 ( Alex Essaijan )
2	Public	1	$6$	0.00222 ( Shotte )
3	Public	1	$3$	0.01162 ( AmbrosM )
4	Private	1	$3$	0.01838 ( AmbrosM )
5	Public	1	$3$	0.01301 ( ESA Sports )
6	Private	1	$2$	0.00724 ( Icees8 )

Appendix

Table 5: Details of all triggers. The best

\text{NMAE}_{range}

among all submissions for each trigger is reported together with the team who reached it. The color scale marks the relative difficulty of trigger reconstruction from easy (green) to difficult (red).

Backdoor Detection

Backdoor detection finds hidden triggers or poisoned behavior in trained models before they can secretly redirect predictions or actions.

See all 53 papers

Adversarial Robustness of Deep State Space Models for Forecasting
Apr 3, 2026Sribalaji C. Anand, George J. PappasAdversarial Robustness State Space Models
Department of Electrical and Systems Engineering, University of Pennsylvania, United States · KTH Royal Institute of Technology, Sweden
Forecasting Source Stability in Scientific Experiments using Temporal Learning Models: A Case Study from Tritium Monitoring
May 2, 2026Nicholas Tan Jerome, Nadia Aouadi, Christoph Koehler +2Event Time Prediction Long-Term Time Series Forecasting
Institute for Data Processing and Electronics, Karlsruhe Institute of Technology, Germany · Schmalkalden University of Applied Sciences, Schmalkalden, Germany · Technical University Munich, Garching, Germany +1
TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
May 21, 2026Quang Duc Nguyen, Siyuan Liang, Yiming Li +2Backdoor Attacks Time Series Forecasting
College of Computing and Data Science, Nanyang Technological University, Singapore.

Apr 3, 2026J/K move · Enter open · S save

Adversarial Robustness of Deep State Space Models for Forecasting

Sribalaji C. Anand, George J. Pappas

Department of Electrical and Systems Engineering, University of Pennsylvania, United States · KTH Royal Institute of Technology, Sweden

Adversarial Robustness State Space Models Black-Box Adversarial Attacks

Open paper AskPDF arXiv

State-space model (SSM) for time-series forecasting have demonstrated strong empirical performance on benchmark datasets, yet their robustness under adversarial perturbations is poorly understood. We address this gap through a control-theoretic lens, focusing on the recently proposed Spacetime SSM forecaster. We first establish that the decoder-only Spacetime architecture can represent the optimal Kalman predictor when the underlying data-generating process is autoregressive - a property no other SSM possesses. Building on this, we formulate robust forecaster design as a Stackelberg game against worst-case stealthy adversaries constrained by a detection budget, and solve it via adversarial training. We derive closed-form bounds on adversarial forecasting error that expose how open-loop instability, closed-loop instability, and decoder state dimension each amplify vulnerability - offering actionable principles towards robust forecaster design. Finally, we show that even adversaries with no access to the forecaster can nonetheless construct effective attacks by exploiting the model's locally linear input-output behavior, bypassing gradient computations entirely. Experiments on the Monash benchmark datasets highlight that model-free attacks, without any gradient computation, can cause at least 33% more error than projected gradient descent with a small step size.

Abstract

Backdoor Detection

Explore similar work

Adversarial Robustness of Deep State Space Models for Forecasting

Forecasting Source Stability in Scientific Experiments using Temporal Learning Models: A Case Study from Tritium Monitoring

TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting