Fortifying Time Series: DTW-Certified Robust Anomaly Detection

Abstract: Time-series anomaly detection is critical for ensuring safety in high-stakes applications, where robustness is a fundamental requirement rather than a mere performance metric. Addressing the vulnerability of these systems to adversarial manipulation is therefore essential. Existing defenses are largely heuristic or provide certified robustness only under $\ell_p$-norm constraints, which are incompatible with time-series data. In particular, $\ell_p$-norm fails to capture the intrinsic temporal structure in time series, causing small temporal distortions to significantly alter the $\ell_p$-norm measures. Instead, the similarity metric \emph{Dynamic Time Warping} (DTW) is more suitable and widely adopted in the time-series domain, as DTW accounts for temporal alignment and remains robust to temporal variations. To date, however, there has been no certifiable robustness result in this metric that provides guarantees. In this work, we introduce the first \emph{DTW-certified robust defense} in time-series anomaly detection by adapting the randomized smoothing paradigm. We develop this certificate by bridging the $\ell_p$-norm to DTW distance through a lower-bound transformation. Extensive experiments across various datasets and models validate the effectiveness and practicality of our theoretical approach. Results demonstrate significantly improved performance, e.g., up to 18.7\% in F1-score under DTW-based adversarial attacks compared to traditional certified models.

• The paper introduces a DTW-certified defense using randomized smoothing with percentile bounds to robustly detect anomalies in time-series data.
• It leverages the Keogh lower bound to translate ℓ2 certificates into DTW-certified radii, achieving an 18.7% F1-score improvement on challenging datasets.
• Empirical evaluations demonstrate high certified coverage and minimal performance trade-offs, enabling practical deployment in high-stakes monitoring applications.

DTW-Certified Robust Robustness for Time Series Anomaly Detection

Motivation and Problem Statement

Time-series anomaly detection is foundational in high-stakes applications such as medical monitoring, finance, and critical infrastructure. Robustness to adversarial manipulation is an operational necessity rather than an optional performance enhancement. While adversarial robustness has been extensively studied in the image and text domains, established defenses exploit $\ell_p$-norm constraints, which are inherently misaligned with the characteristics of time-series data. Adversarial examples under $\ell_p$ norms do not reflect temporal structural changes: minor shifts or rescalings can cause substantial $\ell_p$ distances without genuine semantic alteration. This leads to significant gaps in both theoretical and empirical robustness for time-series detectors subject to temporally plausible adversarial perturbations.

Dynamic Time Warping (DTW) is the canonical metric for time-series similarity, reflecting optimal temporal alignment under elastic shifts. While DTW-based adversarial attacks have demonstrated the limitations of $\ell_p$-certified defenses—since the set of DTW-constrained perturbations forms a strict superset—no certifiable robustness result for DTW had previously existed. This work addresses this key gap by establishing a robust, certifiable defense against DTW-based adversaries in time-series anomaly detection.

Methodology: A General Framework for DTW-Certified Robustness

The core contribution is the introduction of a model-agnostic, certifiably robust defense for anomaly detection under DTW perturbations. The framework adapts randomized smoothing—a proven approach for $\ell_p$-certified models—to the time-series domain by leveraging percentile-based smoothing and establishing a link between $\ell_p$ and DTW robustness certificates.

Randomized Smoothing with Percentile Bounds:

Traditional randomized smoothing certifies robustness by classifying with respect to the Gaussian-averaged output of a base classifier. However, time-series anomaly scores are generally unbounded with high output variance, making mean-based smoothing unreliable. This work adopts a percentile-based smoothing, constructing a smoothed function $h_p(x)$ via percentile estimation over Gaussian-perturbed inputs. Monte Carlo sampling is used at inference to empirically bound the percentiles with statistical guarantees.

Keogh Lower Bound for DTW Certificates:

Exact DTW computation is quadratic in sequence length, motivating the use of the Keogh lower bound (LB_Keogh) to efficiently estimate certifiable radii. The method establishes a strict lower bound relation, enabling translation of the smoothed model's $\ell_2$-certificate to a DTW-certified radius. This enables formal robustness guarantees for any anomaly detector: if no perturbed input within a given DTW distance can alter the model's output, certification is achieved.

Theoretical Results:

The paper formally proves that percentile-smoothed anomaly detectors can be certified under DTW by transiting $\ell_2$ certificates through lower-bound analysis, yielding a closed-form for the certified DTW radius parameterized by the smoothing noise, dataset structure, and the Keogh envelope widths. The robustness guarantee is probabilistic with explicit control over statistical confidence (via the chosen percentile and sampling parameters).

Empirical Results and Strong Claims

The DTW-certified defense is evaluated across multiple state-of-the-art anomaly detection architectures (COUTA, TimesNet, DeepSVDDTS) and a suite of canonical time-series datasets encompassing diverse modalities and challenge characteristics. The following performance claims are substantiated:

• Superior Robustness: Across all settings, the DTW-certified defense yields significantly higher F1-score and ROC AUC under strong DTW-constrained adversarial attacks compared to both undefended and $\ell_p$-certified detectors. Notably, on the UCR-1 dataset, the DTW-certified detector demonstrates an 18.7% higher F1-score than the $\ell_p$0-certified baseline under attack.
• Minimal Performance Trade-off: With typical hyperparameter choices (smoothing standard deviation $\ell_p$1), robustness improvements are achieved with negligible degradation—and occasionally modest improvement—in standard anomaly detection performance metrics on clean data.
• High Certified Coverage: The fraction of test instances for which nontrivial (nonzero) DTW-certified radii are guaranteed is substantial (e.g., >90% for several settings), demonstrating broad practical applicability.
• Certified Metrics: The framework offers not only certified accuracy but also certified confusion matrices and certified F1-scores, facilitating fine-grained evaluation under adversarial threat budgets.

Practical and Theoretical Implications

Practical Impact

The proposed DTW-certified defense offers a model-agnostic, drop-in defense mechanism for robustifying already trained time-series anomaly detectors. There is no requirement for adversarial re-training or modification of detection architectures. This has immediate deployability for practitioners in medical, financial, and industrial monitoring domains where certifiable guarantees are essential for regulatory compliance and operational peace of mind.

Theoretical Implications

This work establishes for the first time a general route to certifiable robustness under non-$\ell_p$2 metrics that are semantically aligned with the application domain. The theoretical framework also generalizes to arbitrary $\ell_p$3 norms and corresponding norm-induced DTW variants, showing the extensibility of the approach.

The adoption of percentile smoothing addresses instability inherent in the unbounded outputs characteristic of anomaly detection functions, making this framework a paradigmatic example of adapting certification techniques beyond classification to broader ML settings.

Limitations and Future Directions

• The reliance on Monte Carlo sampling incurs nontrivial test-time computational overhead, especially for long time series or low-variance confidence intervals. Exploration of variance-reduced estimators or adaptive noise allocation may ameliorate this limitation.
• Certification tightness is ultimately controlled by the quality of the Keogh lower bound—further tightening these bounds or discovering new relaxations will yield stronger certificates.
• Extension of DTW-certified robustness to time-series classification, forecasting, and multi-modal settings is a logical next step.

Conclusion

This work presents the first certifiably robust defense for time-series anomaly detection under the DTW metric. By adapting randomized smoothing with percentile estimation and bridging $\ell_p$4 certificates through Keogh lower bounds, it delivers strong robustness guarantees in a model- and dataset-agnostic manner. The empirical results validate substantial improvements over prior approaches, demonstrating the need for DTW-based certifications in realistic adversarial settings. This contribution substantially advances the state of certified robustness for time-series analysis and opens new research avenues in certifiable robustness for structured and temporally-aware data.