Attack Temporality: Temporal Dynamics

• Attack temporality is the study of time-based structures in attacks, detailing the timing from payload installation to execution and observable effects.
• It encompasses various models such as session-bounded delays, continuous-time success probabilities, and temporally localized exposure intervals.
• Mathematical frameworks and empirical benchmarks are used to design defenses that mitigate timing vulnerabilities through temporal aggregation and validation.

Searching arXiv for the cited papers to ground the article in fresh paper metadata. Taken together, recent security literatures suggest that attack temporality is the temporal structure of an attack: the relation between payload installation, exposure, activation, propagation, and observable effect. In some settings it is modeled as a success probability that evolves with time; in others as a bounded attack window, a delay between trigger exposure and activation, a temporally localized perturbation, or a cross-session persistence class. The concept appears in attack-tree analysis, data poisoning, browser-use agents, diffusion-model backdoors, sequential adversarial examples, quantum synchronization attacks, and agentic AI security, where it serves both as a modeling primitive and as a basis for defense design (Kumar et al., 2015, Chu, 25 Apr 2026).

1. Conceptual definitions and taxonomies

A formal treatment of attack temporality appears in the agentic-AI security literature, where the temporality class $\tau(a)$ of an attack $a$ is defined by the installation-to-execution gap, i.e., the elapsed time between introduction of the attack payload and its harmful realization. For T1–T3 this gap is bounded by session structure; for T4 it is not (Chu, 25 Apr 2026). This formulation is notable because it separates where an attack lives in the architecture from when it manifests.

The same idea is instantiated differently in other domains. In Dynamic Countermeasure Trees, the attacker’s success is explicitly time-dependent, with each basic step endowed with an exponential clock (Kumar et al., 2015). In browser-use agents, attack temporality is the TOCTOU window $\Delta t=t_u-t_c$ between observation and execution, during which page state may change (Jiang et al., 28 Feb 2026). In temporal data poisoning, attack temporality is captured by earliness and duration, which measure how far in advance the attack began and how long it lasted (Wang et al., 2023). In delayed backdoors, the central temporal object is the latency phase between trigger exposure and outbreak (Ding et al., 12 Mar 2026).

The four temporality classes introduced for agentic systems provide a compact taxonomy for installation-to-activation delay (Chu, 25 Apr 2026).

Class	Gap structure	Representative threats
T1 Instantaneous	Gap $=0$; same inference call	Classical prompt injection; jailbreak
T2 Session-Persistent	Bounded by one session	In-session chain-of-thought hijack; MCP description poisoning
T3 Cross-Session Cumulative	Spans at least one session boundary	Memory poisoning via RAG
T4a / T4b	Not session-bounded	Alignment drift; dormant weight-space backdoor

This taxonomy suggests that attack temporality is not a single metric but a family of temporal abstractions. Some are stochastic and continuous-time, some are discrete and session-bounded, and some are stateful without any natural session boundary.

2. Mathematical models of time-dependent attack behavior

In Dynamic Countermeasure Trees, a time-dependent attack is modeled by a tuple

$$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$

where $G=(V,E)$ is a finite directed acyclic graph, $r$ is the unique root, $L$ labels nodes as gates or leaf events, and each leaf carries a rate $\lambda_v>0$ (Kumar et al., 2015). For a basic attack step $v$, the success probability over time is

$a$0

with $a$1 when a static success probability $a$2 over a reference time $a$3 is given. AND-gates compose via

$a$4

and OR-gates via

$a$5

Countermeasure gates are modeled as sequential detection and mitigation, with a convolution-based closed form for $a$6 (Kumar et al., 2015). The core move is to replace a static probability by a time-indexed family $a$7.

A different continuous-time construction appears in quantum clock synchronization, where the attacker injects a time-dependent asymmetric delay

$a$8

so that the observed synchronization error becomes

$a$9

Three temporal modes are defined: a jump attack, a spike attack, and a gradual attack. The experiments use two linear drift rates, $\Delta t=t_u-t_c$0 ps per 35 s for 2100 s and $\Delta t=t_u-t_c$1 ps per 35 s, then reversed $\Delta t=t_u-t_c$2 ps/35 s, over 1750 s and 3500 s (Han et al., 24 Oct 2025). Here the temporal profile of $\Delta t=t_u-t_c$3 determines whether short-term or long-term stability is degraded.

Delayed backdoor attacks introduce an explicitly stateful latency model. Let $\Delta t=t_u-t_c$4 be the cumulative count of valid trigger occurrences,

$\Delta t=t_u-t_c$5

and let the decay proxy be

$\Delta t=t_u-t_c$6

Activation occurs once $\Delta t=t_u-t_c$7, equivalently when $\Delta t=t_u-t_c$8, with minimal trigger count

$\Delta t=t_u-t_c$9

A discretized schedule $=0$0 and the predicate $=0$1 then separate latency mode from outbreak mode (Ding et al., 12 Mar 2026). This model makes the delay itself a tunable attack parameter rather than an incidental artifact.

These three formalisms represent distinct uses of time: as stochastic completion time, as a controlled physical waveform, and as a stateful activation counter. Their common feature is that attack efficacy depends on when malicious influence is introduced and when it is allowed to act.

3. Temporal windows, budgets, and exposure intervals

In temporal data poisoning, the attack budget is not the number of poisoned samples but the temporal extent of the poisoning campaign. On a discrete timeline $=0$2, each sample is a triple $=0$3 with birth date $=0$4, and the poisoned set is

$=0$5

Under partial reliability of birth dates, if the attack period is $=0$6, every poisoned sample’s timestamp must satisfy $=0$7 (Wang et al., 2023). Two temporal budgets are then defined:

$=0$8

and

$=0$9

The resulting robustness notion guarantees correct classification for all attacks bounded by earliness or duration, regardless of how many samples are poisoned (Wang et al., 2023).

Browser-use agents expose a finer-grained temporal object: the TOCTOU interval $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$0 between “check time” and “use time.” If the page state changes so that

$$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$1

the planned action is rebound to a different element or value, producing a TOCTOU vulnerability (Jiang et al., 28 Feb 2026). The benchmark distinguishes three attack vectors triggered by changes in that interval: Type I: UI changes, Type II: Data changes, and Type III: Expiring state. In this setting, temporality is not about cumulative exposure but about the vulnerability of a short action-execution gap.

A third window-based formulation is used for diffusion-model backdoors. TEMPO-Diffusion confines malicious behavior to a contiguous reverse-diffusion exposure interval $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$2, with a time-dependent trigger $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$3 inside the interval and $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$4 outside it (Aiken et al., 24 Jun 2026). Beginning, middle, and end exposures are evaluated at $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$5, $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$6, and $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$7 of the reverse trajectory, with window types Box, Hann, and Abridged. The reported trend is strongly temporal: beginning and middle exposures yield backdoor rates up to 30% under clean-noise, whereas end exposures produce $$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$8; larger trigger size amplifies this temporal sensitivity (Aiken et al., 24 Jun 2026).

These examples show three distinct notions of temporal budget. Earliness and duration bound attack campaigns over months; TOCTOU windows bound a planning-execution race over seconds; exposure intervals localize malicious influence to selected timesteps of a generative process. This suggests that temporal attack analysis depends on matching the granularity of time to the system under study.

4. Temporal coherence in sequential adversarial attacks

Several recent attacks exploit the fact that sequential models impose consistency constraints across time. In time-series forecasting, the central observation is that overlapping sliding windows make per-sample perturbations temporally inconsistent when the same timestamp receives different perturbations in different windows. Temporally Unified Adversarial Perturbations (TUAPs) replace per-sample perturbations by a global sequence

$$\mathrm{D\!-\!ACT}=\bigl(G,r,L,\{\lambda_v\}_{v\in V}\bigr),$$9

so that for any overlapping samples the perturbation at shared timestamp $G=(V,E)$0 is identical:

$G=(V,E)$1

The optimization is carried out by the Timestamp-wise Gradient Accumulation Method (TGAM), which aggregates local gradients from all windows covering each timestamp (Su et al., 12 Feb 2026). This is a direct use of temporality as a structural constraint on admissible perturbations.

In reinforcement learning, temporality is modeled as correlation across the perturbation sequence $G=(V,E)$2. The Advantage-based Adversarial Transformer (AAT) generates time-correlated adversarial examples by multi-scale causal self-attention and a weighted advantage

$G=(V,E)$3

which guides sampling toward high-advantage regions (He, 23 Feb 2026). The paper proposes lag-1 Pearson correlation $G=(V,E)$4 and mutual information $G=(V,E)$5 as temporal-correlation measures, and reports that MSCSA+advantage sequences exhibit $G=(V,E)$6 versus $G=(V,E)$7 for single-step attacks like FGSM (He, 23 Feb 2026). Here temporality is not only about delay but about coherent multi-step control.

Event-driven spiking neural networks expose an even narrower temporal channel. Spike-retiming attacks preserve spike counts and amplitudes and alter only timestamps under three budgets: per-spike jitter $G=(V,E)$8, total delay $G=(V,E)$9, and tamper count $r$0. Feasibility requires timeline consistency, capacity-1 non-overlap, and rate preservation (Yu et al., 3 Feb 2026). The projected-in-the-loop (PIL) method combines differentiable soft retiming with strict forward projection to maintain a feasible discrete schedule. Experimentally, local jitter under $r$1 fools more than $r$2 of samples, and on DVS-Gesture the attack reaches over $r$3 ASR while touching fewer than $r$4 of spikes under $r$5 (Yu et al., 3 Feb 2026). Temporality is therefore the primary perturbation axis, not a secondary one.

Marked temporal point processes provide a continuous-time analogue. A continuous-time event sequence

$r$6

is perturbed in two stages: event permutation followed by timestamp noise, while maintaining chronological order through linear inequalities $r$7 (Chakraborty et al., 17 Jan 2025). Because direct optimization over permutations is factorially large, PERMTPP replaces the permutation by a soft doubly stochastic matrix obtained with Gumbel-Sinkhorn, and optimizes a combined loss balancing log-likelihood degradation, distance, and ordering constraints (Chakraborty et al., 17 Jan 2025).

Across these attacks, the common principle is that a sequential system often imposes its own temporal admissibility conditions. Effective attacks therefore optimize not only what to perturb but how perturbations must align over time.

5. Detection, mitigation, and temporal robustness

Time-aware defenses generally attempt either to reduce exploitable temporal windows or to certify robustness under bounded temporal budgets. In temporal data poisoning, the baseline defense is Temporal Aggregation, where base classifiers are trained on the last $r$8 periods and the final decision aggregates the votes of the most recent $r$9 classifiers:

$L$0

Theorems 4.2 and 4.3 give provable robustness for bounded earliness and bounded duration (Wang et al., 2023). With $L$1, the method retains nearly the full clean-accuracy fraction (approximately $L$2) certified robust up to 8–11 months of earliness and up to 6–9 months of duration (Wang et al., 2023).

For browser-use agents, the proposed mitigation is pre-execution validation based on a monitor–validate–act cycle. MutationObserver captures DOM deltas, and ResizeObserver captures layout deltas; if either changes during planning, the action is aborted and the user is alerted (Jiang et al., 28 Feb 2026). The residual window is reported as $L$3 s against planning times of 10–15 s, a greater than $L$4 reduction in the TOCTOU window. On all 14 benchmark cases, over 10 runs each, 0% of TOCTOU attacks succeeded once validation was enabled, versus 100% before (Jiang et al., 28 Feb 2026).

Stateful detection systems also exploit temporal structure. A two-phase detector first identifies subsequences of highly similar queries using a randomized window-hash approximation, then analyzes the temporal correlation of soft labels by the Ljung–Box statistic

$L$5

flagging a sequence when the $L$6-value falls below $L$7 (Lee et al., 19 Jun 2026). Reported results show true positive rate reaching 1.00 and false positive rate of at most 0.06 for Boundary Attack, HSJA, SimBA, and Square Attack, while remaining robust against OARS (Lee et al., 19 Jun 2026). The key temporal feature is serial dependence in the soft-label trajectory.

In D-ACTs, temporality changes countermeasure selection criteria. Instead of minimizing a static attack probability, the defender can read off the delay $L$8 required to reach a target success threshold such as $L$9, then rank countermeasures by $\lambda_v>0$0 after normalizing by cost/skill investment (Kumar et al., 2015). In quantum clock synchronization, detection recommendations are likewise explicitly time-aware: divide time into slices $\lambda_v>0$1 s, randomly switch physical paths per slice, and cross-compare $\lambda_v>0$2 trajectories to detect nonreciprocity (Han et al., 24 Oct 2025).

These defenses indicate that temporal robustness is not merely robustness “over time.” It is robustness under formally bounded exposure windows, persistence classes, or correlation structures.

6. Empirical patterns, benchmarks, and research gaps

Benchmark construction has increasingly treated temporal structure as a first-class experimental variable. In temporal data poisoning, the benchmark simulates continuous data collection and periodic model deployment on the News Category Dataset, with 191,939 headlines across 71 months and 41 categories (Wang et al., 2023). In browser-use agents, the benchmark comprises 9 synthesized scenarios and 5 real-world websites, and shows that every tested agent suffered TOCTOU in at least one scenario (Jiang et al., 28 Feb 2026). In diffusion-model poisoning, CIFAR-10, GTSRB, and CALISA are used to study beginning, middle, and end exposure intervals under clean-noise and backdoor-noise sampling (Aiken et al., 24 Jun 2026).

A different empirical perspective comes from cyberthreat intelligence mining. ChronoCTI processes 713 CTI reports and identifies 124 temporal attack patterns with 718 total instances, distributed as BEFORE: 84 patterns / 506 hits, SIM-OVERLAP: 25 / 168, and CONCURRENT: 15 / 44 (Rahman et al., 2024). The most prevalent category is Baiting → Malicious Execution, followed by Anti-Malware Bypass. This provides a corpus-level view of attack temporality as recurring action chains rather than as perturbation scheduling or activation delay.

Agentic AI surveys reveal a notable asymmetry in current coverage. In a systematic review of 94 papers, the most dangerous emerging threats concentrate at the intersection of high-layer attacks (L5–L7) and slow-burn temporality (T3–T4): covert agent collusion, long-term memory poisoning, MCP supply-chain compromise, and alignment failure that manifests as an insider threat with no external adversary. Yet only 8 of 120 paper-cell assignments, or 7%, fall in this zone (Chu, 25 Apr 2026). Existing evaluation suites such as HarmBench, AgentBench, AgentSecBench, ARE, and Colosseum cover only T1–T2 threats (Chu, 25 Apr 2026).

This distribution suggests that the hardest temporal problems arise when the payload is persistent, activation is delayed, and the relevant evidence is dispersed across sessions or architectural layers. In such settings, call-level filtering and single-session evaluation are structurally mismatched to the threat.

7. Limits, misconceptions, and significance

A common misconception is that attack temporality is simply “how long the attack lasts.” The literature shows a more heterogeneous picture. In some models, temporality is the success distribution over time, as in D-ACTs (Kumar et al., 2015). In others, it is a bounded adversarial budget such as earliness or duration (Wang et al., 2023). Elsewhere it is the gap between observation and execution (Jiang et al., 28 Feb 2026), the placement of a trigger within selected denoising timesteps (Aiken et al., 24 Jun 2026), the requirement that perturbations remain timestamp-consistent across overlaps (Su et al., 12 Feb 2026), or the difference between instantaneous, session-persistent, cross-session cumulative, and non-session-bounded attacks (Chu, 25 Apr 2026).

A second misconception is that temporality is relevant only to stateful or long-horizon systems. Timing-only attacks on spiking neural networks and asymmetric delay attacks on clock synchronization show that even when the attack surface is narrow, the temporal channel alone can be sufficient to induce high attack success or large stability degradation (Yu et al., 3 Feb 2026, Han et al., 24 Oct 2025). Conversely, delayed backdoors show that statefulness can be implemented with lightweight logic inserted into a model graph, allowing a model to remain dormant for a controllable duration before switching into outbreak mode (Ding et al., 12 Mar 2026).

A third misconception is that temporal defenses can be reduced to adding more logging. The surveyed defenses are more specific: pre-execution validation narrows a race window; Temporal Aggregation certifies robustness under temporal budgets; stateful detection tests serial dependence in soft labels; and quantum mitigation requires path randomization and cross-validation over time slices (Jiang et al., 28 Feb 2026, Wang et al., 2023, Lee et al., 19 Jun 2026, Han et al., 24 Oct 2025). The defense mechanism must match the temporal object that defines the attack.

The broader significance of attack temporality lies in this shift of perspective. Security analysis no longer concerns only the location of a vulnerability or the magnitude of a perturbation. It also concerns the scheduling, persistence, correlation, and delayed activation of malicious influence. That shift is visible across formal verification, adversarial machine learning, cyber defense, and autonomous agents, and it increasingly determines both what counts as an attack and what it means to be robust against one (Kumar et al., 2015, Chu, 25 Apr 2026).