In this paper, we analyze and improve the adversarial robustness of a convolutional neural network (CNN) that assists crystal-collimator alignment at CERN's Large Hadron Collider (LHC) by classifying a beam-loss monitor (BLM) time series during crystal rotation. We formalize a local robustness property for this classifier under an adversarial threat model based on real-world plausibility. Building on established parameterized input-transformation patterns used for transformation- and semantic-perturbation robustness, we instantiate a preprocessing-aware wrapper for our deployed time-series pipeline: we encode time-series normalization, padding constraints, and structured perturbations as a lightweight differentiable wrapper in front of the CNN, so that existing gradient-based robustness frameworks can operate on the deployed pipeline. For formal verification, data-dependent preprocessing such as per-window z-normalization introduces nonlinear operators that require verifier-specific abstractions. We therefore focus on attack-based robustness estimates and pipeline-checked validity by benchmarking robustness with the frameworks Foolbox and ART. Adversarial fine-tuning of the resulting CNN improves robust accuracy by up to 18.6 % without degrading clean accuracy. Finally, we extend robustness on time-series data beyond single windows to sequence-level robustness for sliding-window classification, introduce adversarial sequences as counterexamples to a temporal robustness requirement over full scans, and observe attack-induced misclassifications that persist across adjacent windows.
Figures & tables
Figure 1: The principle behind the crystal collimation scheme (visualized for betatron cleaning insertion), showing how the halo particles of the circulating beam are channeled onto the absorber upon correct crystal orientation [ 29 ] .
Figure 2: On-the-fly classification during a crystal rotation. At time instant i , the classifier takes the last W samples (up to i ) of the highlighted window at the right. Top: crystal BLM (dark blue) and secondary BLM (light blue) as a function of time and radiation dose detection; Bottom: predicted class probabilities per window.
Figure 3: Conceptual overview of the deployed classification pipeline [Section 2.2 ] and the robustness problem studied in this paper [Section 2.3 , Section 3 ]. The local robustness property is defined over structured signal-space perturbations δ∈Δ(X) of the input X . Adversarial analysis can target either the signal space (sound but requiring preprocessing to be considered [Section 4 ]) or the normalized input space (where naive attacks may violate the threat model).
Figure 4: Infeasible adversarial example Z^i in the normalized space.
Configuration
Foolbox
ART
Baseline
0.794→0.794
0.838→0.838
No-normalization
0.733→0.831
0.777→0.868
No-padding
0.669→0.899
0.716→0.919
Naive (mask+renorm)
0.669→0.669
0.713→0.713
Naive (no mask/renorm)
0.095→0.767
0.152→0.818
Table 2: Robust accuracy (RA) on the same test split (B=296) under different configurations. Each cell shows RAtool→RApipe , i.e., tool-reported robustness in the optimization space followed by pipeline-checked robustness under C and Δ(⋅) .
Table 3: Comparison of clean accuracy and three RA configurations under the baseline model and an adversarially trained model. The configurations use the following channel budgets: [email protected](εcom,εind)=(0.05,0.01) ; [email protected](εcom,εind)=(0.1,0.02) ; [email protected](εcom,εind)=(0.2,0.04) .
Figure 5: Proof-of-concept adversarial sequence attack. Top: BLM Crystal and Secondary signals (dashed) and their perturbed counterparts (solid). Bottom: class probabilities as the sliding window advances. The perturbation smoothly flips classifications from channeling to partial well in the targeted region [190, 205].