State-space model (SSM) for time-series forecasting have demonstrated strong empirical performance on benchmark datasets, yet their robustness under adversarial perturbations is poorly understood. We address this gap through a control-theoretic lens, focusing on the recently proposed Spacetime SSM forecaster. We first establish that the decoder-only Spacetime architecture can represent the optimal Kalman predictor when the underlying data-generating process is autoregressive - a property no other SSM possesses. Building on this, we formulate robust forecaster design as a Stackelberg game against worst-case stealthy adversaries constrained by a detection budget, and solve it via adversarial training. We derive closed-form bounds on adversarial forecasting error that expose how open-loop instability, closed-loop instability, and decoder state dimension each amplify vulnerability - offering actionable principles towards robust forecaster design. Finally, we show that even adversaries with no access to the forecaster can nonetheless construct effective attacks by exploiting the model's locally linear input-output behavior, bypassing gradient computations entirely. Experiments on the Monash benchmark datasets highlight that model-free attacks, without any gradient computation, can cause at least 33% more error than projected gradient descent with a small step size.
Figures & tables
Fig. 1: Problem setup: the adversary (red) injects attack signal into the data stream, producing corrupted input y~k to the SSM-Forecaster. The detector uses y~k and y^k to raise an alarm.
Fig. 2: Spacetime architecture (left) and layer components (right). Here GeLU represents a Gaussian Error Linear Unit activation function, and Linear denotes a linear activation function.
Fig. 3: Forecaster performance on test data excerpt (left) and distribution of absolute percentage errors (right). Mean Absolute Percentage Error: 6.53% .
Clean
Attack
Adv.
Adv. MAE
Model
MAE
Norm
MAE
∥a∥
Baseline
48.18
−
−
−
Fine-tuned (CNN)
46.36
634.49
224.86
0.35
Fine-tuned (Norm)
46.20
236.09
107.87
0.46
Fine-tuned (classical)
46.35
397.04
153.91
0.39
TABLE I: Model Robustness Evaluation across Different Detectors
Fig. 4: Adversarial error as a function of ℓ (left) and h (right), with approximately constant spectral radius across models in both experiments.
Fig. 5: Adversarial error caused by PGD attacks, and data-driven attacks.
Baseline (CNN Det.)
Fine-tuned (CNN Det.)
Baseline (Norm Det.)
Detector setup
Clean
Adv.
Clean
Adv.
PGD
DDA
Threshold
Encoder
Encoder
Dataset
MAE
MAE
MAE
MAE
MAE
MAE
δnorm
δCNN
layers
dim.
S.F. Traffic
0.01206
0.06922
0.01274
0.06549
0.0692
0.2607
1
1.8
4/8
6
River Flow
10.62
12.06
7.35
10.10
8.89
12.43
10
0.9
8/16
2
U.S. Births
379.1
380.3
366.1
367.2
379.5
922.4
4500
0.8
4/8
3
TABLE II: Robustness evaluation across Monash benchmark datasets in [ 27 ]
Time series forecasting requires extrapolating the dynamics of an observed process beyond the last available measurement. Yet recurrent forecasting models typically treat observations as inputs that directly control their latent dynamics. It leads to a regime change when these observations become unavailable at prediction time. Following a state-estimation perspective, we introduce Observer State-Space Models (OSSMs), a class of recurrent models that interprets the observed input time series as measurements of an underlying autonomous dynamical system. OSSMs explicitly separate latent-state propagation from measurement assimilation: a single transition governs the dynamics across both context and forecasting intervals, while available observations correct the estimated state through an observer. This formulation naturally exposes classical control-theoretic properties, including observability and convergence of the state estimation error. We further show that conventional and recent SSMs can be recovered as particular instances of our OSSM framework, thereby providing a unified interpretation of their recurrent dynamics and revealing modeling inconsistencies. We perform experiments across several benchmarks showing that OSSM achieves substantial improvements while maintaining the same parameter count and training setup as the corresponding SSM baseline. These results support a simple principle for recurrent forecasting: observations should correct the estimated latent state, rather than control the dynamics used to propagate it.
Time-series forecasting aims to predict future values by modeling temporal dependencies in historical observations. It is a critical component of many real-world systems, where accurate forecasts improve operational efficiency and help mitigate uncertainty and risk. More recently, machine learning (ML), and especially deep learning (DL)-based models, have gained widespread adoption for time-series forecasting, but they remain vulnerable to adversarial attacks. However, many state-of-the-art attack methods are not directly applicable in time-series settings, where storing complete historical data or performing attacks at every time step is often impractical. This paper proposes an adversarial attack framework for time-series forecasting under an online bounded-buffer setting, leveraging an informed and selective attack strategy. By selectively targeting time steps where the model exhibits high confidence and the expected prediction error is maximal, our framework produces fewer but substantially more effective attacks. Experiments show that our framework can increase the prediction error up to 2.42x, while performing attacks in fewer than 10% of time steps.
Deep State-Space Models (Deep SSMs) have shown promising performance and computational benefits in processing of time-series data with complex temporal dependencies. Spiking neural networks (SNNs) constitute a biologically inspired class of deep SSMs, where computing blocks communicate through spikes, discrete single-bit events rather than continuous activation functions. A particularly important task in time-series processing is forecasting, i.e. predicting future values of a sequence from past observations alone. However, how to best perform forecasting with SNNs is an open question, where the standard autoregressive nature of the data processing with SNNs requires values that are not available during the forecasting phase. In this article, we address this challenge. We explore two closed-loop forecasting strategies, in which the network's own generated values are fed back into the network as if they were observed past values: (i) model-level and (ii) layer-level closed-loop forecasting. We evaluate these approaches on the ETT-small datasets, a standard benchmark for time-series forecasting, under both spike-based and continuous activation functions. We compare the proposed closed-loop approaches against state-of-the-art methods such as SpaceTime, as well as the zero-masking baseline in S4. Both of the proposed approaches perform comparably to or better than zero-masking with S4, and in most cases match SpaceTime. These findings highlight the trade-off between continuous and low-bit quantized activations, and demonstrate that the proposed Deep SSM architectures provide a competitive framework for forecasting.
Erik Stolt, Sanja Karilanova, Ayca Ozcelikkale
Department of Electrical Engineering, Uppsala University, Uppsala, Sweden