Adversarial Robustness of Deep State Space Models for Forecasting

Sribalaji C. Anand; George J. Pappas

cs.LGApr 3, 2026

Adversarial Robustness of Deep State Space Models for Forecasting

Authors: Sribalaji C. Anand, George J. Pappas

Organizations: Department of Electrical and Systems Engineering, University of Pennsylvania, United States · KTH Royal Institute of Technology, Sweden

Abstract

State-space model (SSM) for time-series forecasting have demonstrated strong empirical performance on benchmark datasets, yet their robustness under adversarial perturbations is poorly understood. We address this gap through a control-theoretic lens, focusing on the recently proposed Spacetime SSM forecaster. We first establish that the decoder-only Spacetime architecture can represent the optimal Kalman predictor when the underlying data-generating process is autoregressive - a property no other SSM possesses. Building on this, we formulate robust forecaster design as a Stackelberg game against worst-case stealthy adversaries constrained by a detection budget, and solve it via adversarial training. We derive closed-form bounds on adversarial forecasting error that expose how open-loop instability, closed-loop instability, and decoder state dimension each amplify vulnerability - offering actionable principles towards robust forecaster design. Finally, we show that even adversaries with no access to the forecaster can nonetheless construct effective attacks by exploiting the model's locally linear input-output behavior, bypassing gradient computations entirely. Experiments on the Monash benchmark datasets highlight that model-free attacks, without any gradient computation, can cause at least 33% more error than projected gradient descent with a small step size.

Figures & tables

Fig. 1: Problem setup: the adversary (red) injects attack signal into the data stream, producing corrupted input $\tilde{y}_{k}$ to the SSM-Forecaster. The detector uses $\tilde{y}_{k}$ and $\hat{y}_{k}$ to raise an alarm.

Fig. 2: Spacetime architecture (left) and layer components (right). Here GeLU represents a Gaussian Error Linear Unit activation function, and Linear denotes a linear activation function.

Fig. 3: Forecaster performance on test data excerpt (left) and distribution of absolute percentage errors (right). Mean Absolute Percentage Error: $6.53\%$ .

	Clean	Attack	Adv.	Adv. MAE
Model	MAE	Norm	MAE	${\\|a\\|}$
Baseline	$48.18$	$-$	$-$	$-$
Fine-tuned (CNN)	$46.36$	$634.49$	$224.86$	$\mathbf{0.35}$
Fine-tuned (Norm)	$46.20$	$236.09$	$107.87$	$0.46$
Fine-tuned (classical)	$46.35$	$397.04$	$153.91$	$0.39$

TABLE I: Model Robustness Evaluation across Different Detectors

Fig. 4: Adversarial error as a function of $\ell$ (left) and $h$ (right), with approximately constant spectral radius across models in both experiments.

Fig. 5: Adversarial error caused by PGD attacks, and data-driven attacks.

	Baseline (CNN Det.)		Fine-tuned (CNN Det.)		Baseline (Norm Det.)		Detector setup
	Clean	Adv.	Clean	Adv.	PGD	DDA	Threshold		Encoder	Encoder
Dataset	MAE	MAE	MAE	MAE	MAE	MAE	$\delta_{\rm norm}$	$\delta_{\rm CNN}$	layers	dim.
S.F. Traffic	$0.01206$	$0.06922$	$0.01274$	$0.06549$	$0.0692$	$0.2607$	$1$	$1.8$	$4/8$	$6$
River Flow	$10.62$	$12.06$	$7.35$	$10.10$	$8.89$	$12.43$	$10$	$0.9$	$8/16$	$2$
U.S. Births	$379.1$	$380.3$	$366.1$	$367.2$	$379.5$	$922.4$	$4500$	$0.8$	$4/8$	$3$

TABLE II: Robustness evaluation across Monash benchmark datasets in [ 27 ]

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Correct then Forecast: Observer State-Space Models for Time Series Forecasting
Sep 27, 2026Alexis-Raja Brachet, Guillaume Clavier--Frémond, Abdelhakim Ziani +2Latent Dynamics Modeling Time Series Forecasting
MICS, CentraleSup´elec, Universit´e Paris-Saclay, France · CentraleSup´elec, IETR UMR CNRS 6164, France · Universit`a di Torino, Torino, Italy.
INTARG: Informed Real-Time Adversarial Attack Generation for Time-Series Regression
Apr 13, 2026Gamze Kirman Tokgoz, Onat Gungor, Tajana Rosing +1Adversarial Attacks Time Series Forecasting
San Diego State University, San Diego, CA, USA · University of California, San Diego, CA, USA
Model- and Layer-Level Closed-Loop Forecasting with SSM-Based Spiking Neural Networks
Oct 20, 2026Erik Stolt, Sanja Karilanova, Ayca OzcelikkaleTime Series Forecasting Spiking Neural Networks
Department of Electrical Engineering, Uppsala University, Uppsala, Sweden

Sep 27, 2026J/K move · Enter open · S save

Correct then Forecast: Observer State-Space Models for Time Series Forecasting

Alexis-Raja Brachet, Guillaume Clavier--Frémond, Abdelhakim Ziani, Pierre-Yves Richard+1

MICS, CentraleSup´elec, Universit´e Paris-Saclay, France · CentraleSup´elec, IETR UMR CNRS 6164, France · Universit`a di Torino, Torino, Italy.

Latent Dynamics Modeling Time Series Forecasting State Space Models Time Series Modeling

Open paper AskPDF arXiv

Time series forecasting requires extrapolating the dynamics of an observed process beyond the last available measurement. Yet recurrent forecasting models typically treat observations as inputs that directly control their latent dynamics. It leads to a regime change when these observations become unavailable at prediction time. Following a state-estimation perspective, we introduce Observer State-Space Models (OSSMs), a class of recurrent models that interprets the observed input time series as measurements of an underlying autonomous dynamical system. OSSMs explicitly separate latent-state propagation from measurement assimilation: a single transition governs the dynamics across both context and forecasting intervals, while available observations correct the estimated state through an observer. This formulation naturally exposes classical control-theoretic properties, including observability and convergence of the state estimation error. We further show that conventional and recent SSMs can be recovered as particular instances of our OSSM framework, thereby providing a unified interpretation of their recurrent dynamics and revealing modeling inconsistencies. We perform experiments across several benchmarks showing that OSSM achieves substantial improvements while maintaining the same parameter count and training setup as the corresponding SSM baseline. These results support a simple principle for recurrent forecasting: observations should correct the estimated latent state, rather than control the dynamics used to propagate it.

Abstract

Adversarial Robustness

Explore similar work

Correct then Forecast: Observer State-Space Models for Time Series Forecasting

INTARG: Informed Real-Time Adversarial Attack Generation for Time-Series Regression

Model- and Layer-Level Closed-Loop Forecasting with SSM-Based Spiking Neural Networks