# SWAP: Exploiting Second-Ranked Logits for Adversarial Attacks on Time Series

arXiv: https://arxiv.org/abs/2309.02752 · HTML: https://mlsanity.com/paper/2309.02752/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 29 references that are in the map.
- First posted on arXiv 6 Sep 2023.

## Builds on (most cited first, 16 of 16)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [The UCR Time Series Archive](https://mlsanity.com/paper/1810.07758/) (2018)
- [InceptionTime: Finding AlexNet for Time Series Classification](https://mlsanity.com/paper/1909.04939/) (2019)
- [Adversarial Examples: Attacks and Defenses for Deep Learning](https://mlsanity.com/paper/1712.07107/) (2017)
- [Deep Spatio-Temporal Residual Networks for Citywide Crowd Flows Prediction](https://mlsanity.com/paper/1610.00081/) (2016)
- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Black-box Adversarial Attacks on Video Recognition Models](https://mlsanity.com/paper/1904.05181/) (2019)
- [Decoupled Kullback-Leibler Divergence Loss](https://mlsanity.com/paper/2305.13948/) (2023)
- [Adversarial Attacks on Deep Neural Networks for Time Series Classification](https://mlsanity.com/paper/1903.07054/) (2019)
- [Adversarial Attacks on Time Series](https://mlsanity.com/paper/1902.10755/) (2019)
- [Untargeted, Targeted and Universal Adversarial Attacks and Defenses on Time Series](https://mlsanity.com/paper/2101.05639/) (2021)
- [Towards an Awareness of Time Series Anomaly Detection Models' Adversarial Vulnerability](https://mlsanity.com/paper/2208.11264/) (2022)
- [On the Susceptibility and Robustness of Time Series Models through Adversarial Attack and Defense](https://mlsanity.com/paper/2301.03703/) (2023)

## Built on by (most cited first, 6 of 6)

- [Kolmogorov-Arnold Networks (KAN) for Time Series Classification and Robust Analysis](https://mlsanity.com/paper/2408.07314/) (2024)
- [Understanding Why Large Language Models Can Be Ineffective in Time Series Analysis: The Impact of Modality Alignment](https://mlsanity.com/paper/2410.12326/) (2024)
- [Irregularity-Informed Time Series Analysis: Adaptive Modelling of Spatial and Temporal Dynamics](https://mlsanity.com/paper/2410.12257/) (2024)
- [Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemble](https://mlsanity.com/paper/2409.02802/) (2024)
- [Correlation Analysis of Adversarial Attack in Time Series Classification](https://mlsanity.com/paper/2408.11264/) (2024)
- [Lightweight Defense Against Adversarial Attacks in Time Series Classification](https://mlsanity.com/paper/2505.02073/) (2025)

## Abstract (arXiv)

Time series classification (TSC) has emerged as a critical task in various domains, and deep neural models have shown superior performance in TSC tasks. However, these models are vulnerable to adversarial attacks, where subtle perturbations can significantly impact the prediction results. Existing adversarial methods often suffer from over-parameterization or random logit perturbation, hindering their effectiveness. Additionally, increasing the attack success rate (ASR) typically involves generating more noise, making the attack more easily detectable. To address these limitations, we propose SWAP, a novel attacking method for TSC models. SWAP focuses on enhancing the confidence of the second-ranked logits while minimizing the manipulation of other logits. This is achieved by minimizing the Kullback-Leibler divergence between the target logit distribution and the predictive logit distribution. Experimental results demonstrate that SWAP achieves state-of-the-art performance, with an ASR exceeding 50% and an 18% increase compared to existing methods.