DTW-Certified Robust Defense

• The paper introduces a certified defense framework that guarantees invariant anomaly decisions for all perturbed inputs within a specified DTW radius.
• It employs Gaussian randomized smoothing with percentile scoring to obtain an ℓ2 certificate and then translates it to a DTW certificate via a Keogh lower bound.
• Empirical results across benchmark datasets show that the method improves robustness and F1-score under strong DTW-based adversarial attacks.

Searching arXiv for the specified paper and closely related certification work. DTW-certified robust defense denotes a certified robustness framework for time-series anomaly detection in which robustness guarantees are stated in terms of Dynamic Time Warping (DTW) rather than only in an $\ell_p$ norm. In the formulation introduced by "Fortifying Time Series: DTW-Certified Robust Anomaly Detection" (Liu et al., 8 May 2026), the objective is to guarantee that, for all perturbed inputs within a DTW radius $\varepsilon$, the anomaly detector’s anomaly/benign decision remains unchanged with high probability. The framework is motivated by the mismatch between indexwise $\ell_p$ distances and the temporal alignment structure of time series, and it adapts randomized smoothing by first obtaining an $\ell_2$ certificate for a smoothed anomaly score and then converting that certificate into a DTW certificate through a lower-bound argument based on the Keogh lower bound. In methodological terms, it belongs to a broader line of research that extends randomized smoothing to non-additive metrics by introducing a metric-specific bridge to a normed certificate space, as also exemplified by Wasserstein smoothing in image classification (Levine et al., 2019).

1. Definition and problem setting

The setting is time-series anomaly detection on

$\mathcal{X}=\mathbb{R}^{L\times C},$

where $L$ is sequence length and $C$ is the number of channels. The detector operates on windows of size $T\le L$ and assigns a real-valued anomaly score $f(x)\in\mathbb{R}$. The binary decision rule is

$$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$

where $\varepsilon$0 denotes anomaly and $\varepsilon$1 denotes benign (Liu et al., 8 May 2026).

The central robustness requirement is pointwise and worst-case: the detector should certify that no perturbation within a prescribed radius can flip the anomaly decision. In the threat model considered, the adversary is white-box, has full access to the detector, and has unlimited computation. Given an input $\varepsilon$2, the attacker seeks $\varepsilon$3 such that

$\varepsilon$4

subject to the budget

$\varepsilon$5

This covers both evasion attacks, which hide a true anomaly, and availability attacks, which cause a benign signal to be flagged as anomalous (Liu et al., 8 May 2026).

The motivation is explicitly safety-critical. The cited application domains include healthcare, finance, and infrastructure monitoring, where anomaly detectors may trigger alarms, initiate interventions, or prevent failures. Under that interpretation, robustness is not treated as an average-case performance attribute but as a requirement for provable trust under worst-case perturbations (Liu et al., 8 May 2026).

2. Why DTW is the relevant robustness metric

Standard $\varepsilon$6 threat models are treated as inadequate for time-series data because they compare signals index-by-index and therefore ignore temporal alignment. The paper states the conventional distance as

$\varepsilon$7

This geometry is poorly matched to temporal distortions such as small temporal shifts, local delay, stretching or compression, and rescaling in time, all of which can preserve semantic identity while producing a large $\varepsilon$8 discrepancy (Liu et al., 8 May 2026).

DTW is introduced as the more appropriate similarity and attack metric because it explicitly permits elastic temporal alignment. The DTW distance of norm order $\varepsilon$9 is defined as

$\ell_p$0

where $\ell_p$1 is an admissible alignment path and $\ell_p$2 is the set of all such paths. The path satisfies matched ends, monotonicity and continuity, and the requirement that each time index appears at least once. In the main text, the construction uses $\ell_p$3 (Liu et al., 8 May 2026).

Under this definition, DTW better captures phase shifts, temporal stretching, compression, and local misalignment. The paper therefore argues that previous certified defenses for time-series anomaly detection that simply import $\ell_p$4 smoothing certify the wrong geometry. A model can be certified in an $\ell_p$5 ball and still remain vulnerable to natural or adversarial temporal distortions. The explicit novelty claim is the introduction of the first certified defense for time-series anomaly detection under the DTW distance and, more specifically, the first theoretical framework that provides certified robustness in DTW distance for this problem (Liu et al., 8 May 2026).

A plausible implication is that the notion of robustness becomes application-aligned only when the attack metric respects temporal equivalence classes induced by alignment, rather than only raw samplewise deviations.

3. Smoothed anomaly scoring and the $\ell_p$6 certificate

The defense pipeline begins with an arbitrary anomaly detector with score function $\ell_p$7, then constructs a smoothed anomaly score function $\ell_p$8 using Gaussian randomized smoothing, computes an $\ell_p$9-type certified radius for the smoothed detector using percentile smoothing, and finally converts that $\ell_2$0 certificate into a DTW certified radius (Liu et al., 8 May 2026).

Ordinary smoothing is described as insufficient because the anomaly score is a real-valued scalar and can be unbounded, high variance, and unstable under noise. The adopted alternative is percentile smoothing. With Gaussian noise

$\ell_2$1

the percentile-smoothed anomaly score is

$\ell_2$2

For $\ell_2$3, this behaves as a median-like smoothing rule. The smoothed detector uses $\ell_2$4 in place of $\ell_2$5 and retains the threshold $\ell_2$6 (Liu et al., 8 May 2026).

The paper gives the percentile smoothing certificate in $\ell_2$7 form: $\ell_2$8 where

$\ell_2$9

and $\mathcal{X}=\mathbb{R}^{L\times C},$0 is the standard Gaussian CDF. This provides a sufficient condition ensuring that the smoothed score stays on the same side of the decision threshold throughout an $\mathcal{X}=\mathbb{R}^{L\times C},$1 ball (Liu et al., 8 May 2026).

The certified $\mathcal{X}=\mathbb{R}^{L\times C},$2 radius $\mathcal{X}=\mathbb{R}^{L\times C},$3 depends on whether the smoothed score is above or below the threshold: $\mathcal{X}=\mathbb{R}^{L\times C},$4 This is the radius within which the smoothed decision is unchanged (Liu et al., 8 May 2026).

Within the logic of certified defense, the role of smoothing is therefore modular: it supplies a norm-ball certificate around the test point, and the main theoretical task is to replace that norm geometry with the DTW geometry relevant to temporal distortions.

4. The Keogh lower bound and the bridge from $\mathcal{X}=\mathbb{R}^{L\times C},$5 to DTW

The key technical step is the conversion of the $\mathcal{X}=\mathbb{R}^{L\times C},$6 certificate into a DTW certificate through a lower-bound contradiction argument. For a warping window $\mathcal{X}=\mathbb{R}^{L\times C},$7, the upper and lower envelopes are

$\mathcal{X}=\mathbb{R}^{L\times C},$8

These envelopes characterize, at each time step and channel, the range of values that can align to $\mathcal{X}=\mathbb{R}^{L\times C},$9 within the allowed warping window (Liu et al., 8 May 2026).

The Keogh lower bound is then defined as

$L$0

If a point of $L$1 stays inside the envelope of $L$2, it contributes nothing to the lower bound; only envelope violations contribute. Since this is a lower bound on DTW, any sufficiently large value implies a large DTW distance (Liu et al., 8 May 2026).

The conceptual bridge is stated as Lemma 3.2. If a smoothed function $L$3 satisfies

$L$4

then it also satisfies

$L$5

where $L$6 is a strict lower bound of $L$7 and

$L$8

The proof mechanism is contradiction: if some point had $L$9 while lying outside the safe $C$0 ball, the strict lower bound would violate the definition of $C$1 (Liu et al., 8 May 2026).

The main theorem instantiates this bridge with $C$2. The decision condition is

$C$3

Then robustness is guaranteed for all $C$4 satisfying

$C$5

where

$C$6

with

$C$7

Here $C$8 is the total amount of Euclidean perturbation that can remain inside the envelope with zero Keogh penalty, while $C$9 is the largest single-coordinate slack (Liu et al., 8 May 2026).

The two-case structure is significant. If $T\le L$0, the infimum DTW lower bound outside the $T\le L$1 ball is still $T\le L$2, so the DTW certificate degenerates to $T\le L$3. If $T\le L$4, any point outside the $T\le L$5 ball must protrude beyond the envelope and therefore induce positive Keogh cost, producing a positive DTW certificate. This suggests that certificate quality depends jointly on the smoothing-derived Euclidean radius and on the tightness of the envelope slack permitted by the chosen DTW window.

5. Certification semantics, evaluation protocol, and operationalization

The formal certified-defense definition is pointwise: the detector provides certified defense at input $T\le L$6 with DTW radius $T\le L$7 if there is no $T\le L$8 such that

$T\le L$9

and

$f(x)\in\mathbb{R}$0

with confidence at least $f(x)\in\mathbb{R}$1 (Liu et al., 8 May 2026).

The practical certification procedure is given as a seven-step pipeline. For a test input $f(x)\in\mathbb{R}$2, one samples Gaussian noise $f(x)\in\mathbb{R}$3, computes noisy scores

$f(x)\in\mathbb{R}$4

sorts the scores and estimates confidence bounds on the relevant percentiles using binomial tail bounds, derives the smoothed decision and the $f(x)\in\mathbb{R}$5 certificate radius $f(x)\in\mathbb{R}$6, constructs DTW envelopes $f(x)\in\mathbb{R}$7 for a chosen wrapping window $f(x)\in\mathbb{R}$8, computes the slack values $f(x)\in\mathbb{R}$9 and then $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$0 and $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$1, and finally outputs the DTW certified radius

$$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$2

The method does not require retraining and can be applied to pre-trained anomaly detectors. At inference, the described pipeline is: inject Gaussian noise, optionally pass through a denoising stage, aggregate scores via percentile smoothing, and output the anomaly decision together with the DTW certificate (Liu et al., 8 May 2026).

The empirical study uses seven benchmark datasets, listed in the text as SMAP, MSL, SMD, NIPS-TS-SWAN, NIPS-TS-CREDITCARD, NIPS-TS-WATER, UCR-1, and UCR-2, with UCR split into two subsets. These include both univariate and multivariate anomaly detection tasks. The anomaly detection backbones are COUTA, TimesNet, and DeepSVDDTS. The primary baselines are the undefended base model, a traditional $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$3-norm certified defense based on standard randomized smoothing, and the proposed DTW-certified defense, all evaluated under DTW-based adversarial attacks (Liu et al., 8 May 2026).

Default hyperparameters are sequence length $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$4, DTW wrapping window $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$5, number of noisy samples $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$6, Gaussian noise level $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$7, percentile $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$8, and confidence parameter $$d(x)= \begin{cases} 1, & f(x)>\gamma,\ 0, & f(x)\le \gamma, \end{cases} \tag{1}$$9. The implementation is reported in PyTorch on Linux with Intel Xeon Gold 6326 CPUs and NVIDIA A100 80GB GPUs (Liu et al., 8 May 2026).

The evaluation includes both ordinary detection metrics and certification metrics. Detection performance is measured by point-adjusted F1-score and ROC AUC. Certified radii over test instances are summarized by mean radius, maximum radius, standard deviation, and certified proportion, defined as the fraction with non-zero certificate. The paper also extends certified accuracy to anomaly detection via certified confusion matrices: $\varepsilon$00

$\varepsilon$01

$\varepsilon$02

with

$\varepsilon$03

$\varepsilon$04

These are conservative worst-case metrics (Liu et al., 8 May 2026).

6. Empirical findings, trade-offs, and methodological context

The reported results indicate that the defense is broadly applicable across datasets and models, often with only small degradation and occasionally even improvement in clean detection performance. One example from Table 1 is NIPS-TS-WATER with DeepSVDDTS, where the method certifies $\varepsilon$05 of test inputs with mean DTW certified radius $\varepsilon$06, with no performance degradation in F1 or AUC. On many tasks, DeepSVDDTS attains the strongest robustness, which the authors state may be because it handles noisy inputs better. Robustness is weaker on datasets such as SMAP and NIPS-TS-SWAN, which the paper attributes to higher channel dimensionality, higher variance, and looser lower-bound estimation (Liu et al., 8 May 2026).

Under strong DTW-based adversarial attack, the main empirical comparison is between undefended models, $\varepsilon$07-certified models, and the DTW-certified defense at attack budget

$\varepsilon$08

This budget exceeds the average certified radius of roughly $\varepsilon$09 and is presented as a strong stress test. DTW attacks severely damage undefended models, with F1 drops of $\varepsilon$10 on SMD and $\varepsilon$11 on UCR-1. The $\varepsilon$12-certified defense improves robustness somewhat but remains inconsistent when attacks involve strong temporal distortions. The DTW-certified defense consistently outperforms both baselines: on MSL, F1 under attack improves from $\varepsilon$13 for the $\varepsilon$14-certified defense to $\varepsilon$15 for the DTW-certified defense, a gain of $\varepsilon$16 percentage points; on UCR-1, F1 improves from $\varepsilon$17 to $\varepsilon$18, a gain of $\varepsilon$19 percentage points (Liu et al., 8 May 2026).

The paper also reports dataset-level certified performance curves. Figure 1 shows certified F1 and certified accuracy versus DTW attack budget $\varepsilon$20 for COUTA on MSL and SMAP under both evasion and availability attacks. On SMAP, with suitable $\varepsilon$21 such as $\varepsilon$22, the defense maintains certified F1 of roughly $\varepsilon$23 under evasion attack at budget $\varepsilon$24 (Liu et al., 8 May 2026).

The principal trade-off concerns the smoothing noise level $\varepsilon$25. Increasing $\varepsilon$26 generally increases mean certified radius, maximum radius, and certified proportion, but too large a value hurts F1-score and ROC AUC. The examples singled out in the text are that moderate $\varepsilon$27 or $\varepsilon$28 can improve both robustness and sometimes generalization, whereas large $\varepsilon$29 often degrades clean detection. The paper characterizes this as the standard smoothing trade-off: more noise yields larger certificates but can blur the detector. It also notes that moderate smoothing can improve clean performance by stabilizing the decision boundary (Liu et al., 8 May 2026).

The limitations are explicit. Certification requires many noisy evaluations at test time, introducing inference overhead. The DTW certificate is conservative because it is derived through $\varepsilon$30 rather than exact DTW geometry; failure to certify beyond radius $\varepsilon$31 does not imply actual non-robustness beyond that radius. Longer sequences and higher-dimensional multivariate series can reduce certificate tightness, and the use of a Sakoe-Chiba warping window means the quality of the certificate depends on the chosen warping constraint. The scope of the current framework is limited to anomaly detection rather than classification or forecasting (Liu et al., 8 May 2026).

In a broader methodological context, the DTW construction follows the same general research pattern as Wasserstein smoothing: a non-additive metric is not certified directly in raw input space but through a metric-specific reduction that permits the reuse of randomized smoothing machinery. Wasserstein smoothing converts a transport-based perturbation model into an $\varepsilon$32-type perturbation model in flow space and then applies an existing $\varepsilon$33 randomized smoothing certificate (Levine et al., 2019). DTW-certified robust defense does not use a latent additive transformation space in the same way; instead, it converts an $\varepsilon$34 certificate into a DTW certificate through a strict lower-bound bridge. This suggests a broader taxonomy of certified defenses for non-additive metrics: one class reduces the metric to a norm in a transformation space, while another uses provable lower or upper bounds to transfer a norm-ball certificate into the target geometry.