T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Quang Duc Nguyen 1 Siyuan Liang 1 Yiming Li 1 Fushuo Huo 1 Dacheng Tao 1
Abstract
Legend Poisoned Timestamp
arXiv:2605.22365v1 [cs.CR] 21 May 2026
Time Series Forecasting (TSF) plays a critical role across many domains, yet it is vulnerable to backdoor attacks. However, backdoor defenses tailored to TSF remain underexplored, due to data entanglement and task-formulation shift challenges. To fill this gap, we conduct a systematic evaluation of thirteen representative backdoor defenses across the TSF life cycle and analyze their failure modes. Our results reveal two fundamental issues: (1) data entanglement induces channellevel signal dilution, rendering sample-filtering and trigger-synthesis defenses ineffective at localizing backdoors; and (2) task-formulation shift leads to training-loss degeneration, causing poisoned and clean windows to become indistinguishable at training stages. Based on these findings, we propose a training-time backdoor defense for TSF, termed T IME G UARD. Our method adopts channel-wise pool training as the core paradigm and initializes a high-confidence pool using timeaware criteria to mitigate signal dilution. Moreover, we introduce distance-regularized loss selection to progressively expand the reliable pool during training and ease loss degeneration. Extensive experiments across multiple datasets, forecasting architectures, and TSF backdoor attacks demonstrate that T IME G UARD substantially improves robustness, boosting MAEP by 1.96× over the leading baseline, while preserving clean performance within 5% MAEC .
Clean Channel
Original Data
Trigger Pattern
Sample
Attack Pattern
Prediction Clean Channel
Naïve Training
Inference
t
Poisoned Channel
Poisoned Channel Poisoned Model t
(a) Backdoor Injection via Data Poisoning
(b) Training and Inference on Poisoned Data
Figure 1. A backdoor is injected into selected channels during training and activated at inference to manipulate TSF predictions.
ning, and economic analysis. However, recent studies have shown that TSF models are also susceptible to backdoor attacks (Liang et al., 2024b; Liu et al., 2025a; Liang et al., 2025), where an attacker implants hidden trigger patterns into the data during the training phase such that the model behaves normally under benign inputs but outputs attackerspecified predictions under trigger conditions (Lin et al., 2024). This type of attack is highly covert and may pose serious risks to practical applications relying on TSF (Liu et al., 2025c; Zhang et al., 2024b; Liu et al., 2024a), such as undermining the reliability of decision-making and forecasting (Zhang et al., 2015), which highlights the necessity of studying TSF backdoor defense methods (Wang et al., 2022; Liang et al., 2024a; Guo et al., 2024). Although backdoor defense mechanisms have been extensively studied in classification and generative model domains (Wu et al., 2025a; Li et al., 2025; Lin et al., 2025), backdoor defenses for time series forecasting (TSF) remain significantly underdeveloped. Defense against TSF backdoors is still evidently insufficient. This is mainly due to two inherent challenges in TSF scenarios: one is data entanglement, i.e., multivariate time series exhibiting simultaneous channel structure and temporal dependency (Xu et al., 2026a), which causes backdoor injections to be highly coupled with clean signals at the data level; and the other is task-formulation shift, i.e., TSF shifts from discrete classification to continuous-value regression and training window overlap (Kim et al., 2025), resulting in substantial changes in the discriminative signals relied upon by existing defense methods during training (Kuang et al., 2024; Xu et al., 2026b). Therefore, it is often difficult to directly transfer existing backdoor defense techniques to TSF scenarios.
1. Introduction Time Series Forecasting (TSF) is widely used in critical domains such as climate prediction, transportation plan1
Nanyang Technological University, Singapore. Correspondence to: Siyuan Liang <[email protected]>, Dacheng Tao <[email protected]>. Proceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s).
1
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
To fill the above research gap, we conduct a systematic evaluation of backdoor defenses in TSF scenarios by adapting and analyzing 13 representative defense methods across the four phases of the deep neural network lifecycle (Wu et al., 2025a). Experimental results indicate that the failures of existing methods in TSF mainly manifest in two aspects induced by these inherent challenges: first, data entanglement in multivariate time series leads to channel-level signal dilution, where backdoor injections only affect a subset of channels, making it difficult for sample-level filtering and trigger-synthesis-based defenses to accurately localize backdoors when the attack granularity and defense granularity are mismatched; second, task-formulation shift further causes training loss degeneration, and the continuousvalue regression targets together with overlapping window structures result in poisoned and clean windows exhibiting similar loss distributions during early training stages, thereby weakening or even invalidating defense strategies that rely solely on training losses. In addition, we observe that training-phase defenses (Xun et al., 2025; Liang et al., 2024a) remain effective when relatively reliable clean training data are available.
specific failure modes arising from data entanglement and task-formulation shift. • We propose T IME G UARD, a training-time backdoor defense that learns from channel-wise reliable data and effectively mitigates signal dilution and training-loss degeneration without requiring additional clean samples. • We extensively evaluate T IME G UARD on three TSF forecasters, showing consistent mitigation across three TSF attacks with different settings; ablation studies further validate the contribution of each component. Notably, T IME G UARD also transfers to the LLM-based method, yielding at least a 5.14× MAEP gain with only a 3.8% change in clean MAEC .
2. Threat Model Victim model. Time series forecasting (TSF) (Kim et al., 2025) aims to predict future values over one or multiple horizons given historical observations of a univariate or multivariate time series. We consider a multivariate time series dataset denoted as X ∈ RT ×C , where T is the number of time steps and C is the number of variables (or channels). For each forecasting sample indexed by timestamp t, we denote the history (input) window and future (target) window as Xt,h = X[t − Lin : t, :] and Xt,f = X[t : t + Lout , :], where Lin and Lout denote the history and future lengths, and we use half-open indexing (end exclusive). Thus Xt,h ∈ RLin ×C and Xt,f ∈ RLout ×C . Sliding this windowing process over time yields overlapping-window training set D = {(Xt,h , Xt,f ) | Lin ≤ t ≤ T − Lout }, following standard TSF practice (Nie et al., 2023; Lin et al., 2024). A forecasting model fθ maps histories to futures, i.e., fθ : RLin ×C → RLout ×C , and is trained by minimizing a prediction loss (e.g., mean absolute error (MAE) or mean squared error (MSE)) over D.
Based on the above analysis, we propose a training-time backdoor defense method for TSF, termed T IME G UARD. Motivated by training-phase defenses, T IME G UARD adopts Channel-wise reliable pool training as the core paradigm, reconfiguring conventional sample-level training into finergrained channel-level training, thereby exploiting the majority of channel information in multivariate time series that remains reliable. Building upon this paradigm, we further design a time-aware pool initialization strategy, which selects high-confidence time-channel units from two complementary perspectives of learning behavior and temporal structure, providing an initial reliable pool with higher signal purity. Furthermore, to address the training loss degeneration problem induced by task-formulation shift, T IME G UARD introduces a Distance-Regularized Loss Selection mechanism, which progressively expands the reliable pool during training while reducing the risk of highly correlated poisoned windows being reintroduced into the training process, without sacrificing forecasting performance. Through these designs, T IME G UARD effectively mitigates the signal dilution and training loss degeneration without requiring additional clean data. Experiments on three datasets, three forecasting architectures, and three representative TSF backdoor attacks demonstrate that T IME G UARD substantially improves robustness, achieving a 1.96× improvement in MAEP over the leading baseline, while preserving clean performance within 5% MAEC . Due to space constraints, we defer a detailed discussion of related work to Appendix A. Our main contributions are:
Attacker’s capabilities. We follow the TSF poisoning backdoor setup in BackTime (Lin et al., 2024), as depicted in Figure 1. Given a multivariate training series X, the attacker selects (i) a set of poisoned timestamps Tatk with temporal injection rate ηT and (ii) a set of target variables S with spatial injection rate ηS . For each t ∈ Tatk , the attacker generates a trigger pattern Gt ∈ RLtgr ×|S| and overwrites the Ltgr steps immediately preceding t on the target variables: X[t − Ltgr : t, S] ← Gt . The attacker also overwrites the subsequent Lptn future steps: X[t : t + Lptn , S] ← X[t − Ltgr − 1, S] ⊕ P, where P ∈ RLptn ×|S| is a predefined attack pattern template and ⊕ denotes element-wise addition with broadcasting along the time dimension. Thus, the trigger and target patterns are injected consecutively around t. At inference time t0 , the adversary injects the trigger over the Ltgr most recent steps in the input stream, i.e., during [t0 − Ltgr , t0 ). Trigger gen-
• We present the first systematic evaluation of backdoor defenses for time series forecasting, and reveal two TSF2
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 1. Performance comparison of training-phase defenses on Table 2. Detection performance comparison of inference-time dePEMS03 dataset. Best and second results are bold and underline. fenses on three datasets, averaged over three models. Inference time We report performance averaged across the three forecasting models. is measured on 200 samples. Best and second results are bold and underline. Full per-model results are provided in Appendix G.1. Full per-model results are provided in Appendix G.1. Attack →
Random
BackTime
Defense ↓
MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense
17.634 17.772
-
17.607 14.201
-
Spectral (Tran et al., 2018)
18.389 18.356
0.502
18.666 15.245
0.539
TED (Mo et al., 2024)
18.434 20.063
0.528
18.606 13.953
0.495
Dataset
Defense
Total Inference Time (s) ↓
Random
BackTime
AUC ↑ F1 ↑ AUC ↑ F1 ↑
No Defense
2.497
0.500 0.500 0.500 0.500
STRIP (Gao et al., 2019)
278.283
0.518 0.532 0.501 0.516
TeCo (Liu et al., 2023a)
38.407
0.563 0.564 0.478 0.512
PEMS03
TED++ (Le et al., 2025)
19.197 19.184
0.499
18.565 14.541
0.513
IBD-PSC (Hou et al., 2024)
9.903
0.364 0.514 0.486 0.535
Fine-tuning (Gu et al., 2019)
19.003 30.909
0.625
18.934 18.196
0.594
No Defense
2.330
0.500 0.500 0.500 0.500
Fine-pruning (Liu et al., 2018) 19.020 31.643
0.633
18.686 19.736
0.623
STRIP (Gao et al., 2019)
198.480
0.300 0.510 0.497 0.531
NAD (Li et al., 2021b)
18.795 26.809
0.600
18.584 18.158
0.600
TeCo (Liu et al., 2023a)
25.447
0.581 0.590 0.547 0.574
IMS (Dunnett et al., 2025)
19.239 17.731
0.466
18.418 14.351
0.509
IBD-PSC (Hou et al., 2024)
9.838
0.317 0.519 0.390 0.534
ABL (Li et al., 2021a)
19.637 19.104
0.493
18.761 14.481
0.509
No Defense
2.297
0.500 0.500 0.500 0.500
PDB (Wei et al., 2024)
18.630 54.690
0.693
18.967 22.397
0.639
STRIP (Gao et al., 2019)
205.453
0.490 0.525 0.477 0.506
ESTI (Yu et al., 2025)
19.910 17.186
0.454
19.219 15.897
0.532
TeCo (Liu et al., 2023a)
25.443
0.614 0.591 0.524 0.521
T IME G UARD
17.928 104.677 0.868
18.048 39.303
0.808
IBD-PSC (Hou et al., 2024)
9.749
0.378 0.513 0.486 0.518
Weather
ETTm1
eration is constrained to use information available up to the current time (at most t0 ) to respect forecasting timeliness.
3. Revisiting Existing Backdoor Defenses for Forecasting
Attacker’s goals. The attacker aims to poison the training data such that the victim prediction model learns hidden backdoor behaviors (Lin et al., 2024; Xiang et al., 2025): (i) Maintain normal prediction accuracy on clean historical windows; (ii) When the input historical window contains a trigger pattern G on a poisoned channels S, force the model’s predictions on the corresponding channels to follow the attacker-specified target pattern induced by the pre-defined attack template P, while keeping the prediction behavior of the remaining channels unchanged.
This section systematically adapts existing backdoor defenses originally developed for classification to the TSF setting and evaluates their effectiveness. We also introduce FDER as a forecasting-specific metric and analyze the key characteristics and failure modes of existing defenses. 3.1. Experimental Settings Datasets and models. We conduct experiments on three representative datasets, PEMS03 (Song et al., 2020), Weather (Wu et al., 2021), and ETTm1 (Zhou et al., 2022), covering different application domains. Following existing TSF backdoor work (Lin et al., 2024), we evaluate three forecasting models: SimpleTM (Chen et al., 2025a), FEDformer (Zhou et al., 2022), and TimesNet (Wu et al., 2023). We use a 6:2:2 train/validation/test split and report results averaged over the three architectures. More dataset and model details are provided in Appendix F.2 and F.3.
Defender’s capabilities and goals. The defender aims to safeguard forecasting models against backdoor poisoning attacks without prior knowledge of the trigger pattern, attack pattern, or the poisoned timestamps and variables. Depending on the defense strategy, the defender may access different components of the model life cycle, including the training data, the training procedure, the trained model, or only inference-time predictions (Wu et al., 2025a). Some defenses further assume access to a small subset of trusted clean samples (Liu et al., 2018; Wei et al., 2024).
Attack methods. We evaluate against three representative TSF backdoor attacks: Random (Gu et al., 2019), FreqBack-TSF (Huang et al., 2025b), and BackTime (Lin et al., 2024). Random attack injects a fixed random trigger, inspired by BadNets (Gu et al., 2019). FreqBack-TSF adapts FreqBack (Huang et al., 2025b), originally proposed for time series classification, and uses a universal optimized trigger crafted via frequency analysis. BackTime (Lin et al., 2024) is a state-of-the-art TSF attack that generates sampledependent triggers via a GNN-based generator. Unless stated otherwise, we use Lin =Lout =12 with poisoning rates ηT =0.03 and ηS =0.3 following BackTime settings (Lin et al., 2024). Attack details are provided in Appendix F.4.
Accordingly, existing defenses can be broadly categorized into: (i) training-phase defenses, which intervene before, during, or after model training (i.e., pre-training, in-training, or post-training) to obtain models that are robust to backdoor activation while preserving benign forecasting utility and disrupting malicious target alignment (Tran et al., 2018; Li et al., 2021a; Wei et al., 2024); and (ii) inference-time defenses, which detect or suppress triggered inputs at test time without modifying the trained model (Liu et al., 2023a; Gao et al., 2019; Wang et al., 2025).
3
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
0.32 0.00
0.0 0.1 0.2 0.3 0.4 0.5 0.6
Neighboorhood Distance
Poisoned Channels
0.63 0.00
Forecasting Model
0.4
Clean Samples Poisoned Samples
0.2
0.0
0.0 0.1 0.2 0.3 0.4 0.5 0.6
Neighboorhood Distance
1
5
9
Epoch
13
17
Backcasting Model
0.4
Poisoned Samples Clean Samples
Loss
0.63
1.27
Loss
Clean Samples Poisoned Samples
Proportion (%)
Proportion (%)
Clean Channels
20
Poisoned Samples Clean Samples
0.2
0.0
1
5
9
Epoch
13
17
20
Figure 2. Neighborhood distance distributions of poisoned and clean samples, averaged over clean and poisoned channels, on Weather (Wu et al., 2021) under BackTime (Lin et al., 2024). The neighborhood distance is defined in Section 4.
Figure 3. Training loss of clean and poisoned samples, averaged over poisoned channels, for forecasting and backcasting FEDformer models (Zhou et al., 2022) on the Weather dataset (Wu et al., 2021) under BackTime attack (Lin et al., 2024).
Evaluation metrics. Following prior TSF backdoor settings (Lin et al., 2024; Xiang et al., 2025), we report Mean Absolute Error (MAE) on clean inputs (MAEC ) and on triggered inputs (MAEP ) for training-phase defenses. An effective defense should preserve a low MAEC while achieving high MAEP (Gao et al., 2023a; Yu et al., 2025).
3.2. Backdoor Defenses under TSF Setting Since backdoor defenses for TSF remain underexplored, we adapt 13 representative defenses originally developed for classification, covering the four stages of the model life cycle and diverse defense paradigms (Wu et al., 2025a; Li et al., 2022a; Ren et al., 2025). To ensure a fair comparison, we follow each method’s default implementation whenever applicable and apply minimal modifications needed for TSF. Concretely, we replace accuracy-based criteria with MAE-based counterparts, and for inference-time and input-modification defenses we use time-series-specific modifications; otherwise, we keep the original procedures unchanged.
However, in our preliminary evaluation, we observe “false wins,” where MAEP increases primarily because the model’s overall forecasting quality degrades, which is also reflected by a higher MAEC ; the reverse can also occur, as in the IMS defense in Table 1. To capture robustness gains while penalizing clean-performance degradation, we propose the Forecasting Defense Effectiveness Rating (FDER), adapted from DER (Zhu et al., 2023) but defined using relative MAEbased measures suitable for forecasting:
Specifically, we evaluate ten training-phase defenses, including pre-training methods (Spectral (Tran et al., 2018), TED (Mo et al., 2024), TED++ (Le et al., 2025)), posttraining methods (Fine-tuning (Gu et al., 2019), Finepruning (Liu et al., 2018), NAD (Li et al., 2021b), IMS (Dunnett et al., 2025)), and in-training methods (ABL (Li et al., 2021a), PDB (Wei et al., 2024), ESTI (Yu et al., 2025)), as well as three inference-time defenses (STRIP (Gao et al., 2019), TeCo (Liu et al., 2023a), and IBD-PSC (Hou et al., 2024)). More implementation details, our baseline selection rationale, and a comparison of key defense attributes are deferred to Appendix F.7 and B, respectively.
max(0, ρMAEP ) − max(0, ρMAEC ) + 1 ∈ [0, 1], 2 (1) where the relative attack and clean gain are defined as: FDER =
ρMAEP = 1 −
MAEund P , MAEP
ρMAEC = 1 −
MAEund C . (2) MAEC
und Here MAEund P and MAEC denote the attack/clean MAE errors of the undefended backdoored model. Higher FDER indicates stronger backdoor mitigation with smaller cleanperformance overhead. For inference-time defenses, we evaluate detection capability using AUROC and F1 score, where higher values indicate better performance (Liu et al., 2023a; Wang et al., 2025).
3.3. Preliminary Evaluation and Key Insights We summarize training-phase defense results on PEMS03 and inference-time detection results, both under the Random and BackTime attacks in Table 1 and Table 2, respectively. We highlight four empirical insights, which we analyze next.
Thus, in TSF backdoor settings (Lin et al., 2024), benign behavior corresponds to accurate forecasting on clean inputs, reflected by low MAEC ; malicious success corresponds to triggered inputs being steered toward the attacker’s target, reflected by low MAEP ; and general failure corresponds to poor forecasting quality overall, which is also reflected by high clean-input error. Therefore, an effective TSF defense should preserve benign forecasting utility, as indicated by comparable or lower MAEC , while disrupting malicious target alignment, as indicated by higher MAEP or, more compactly, higher FDER, despite attacker-defined trigger and target patterns. Further discussion is in Appendix E.
Insight 3.1: Sample-level filtering and trigger-synthesis style defenses yield limited robustness gains against TSF backdoor attacks. Sample-level filtering defenses (Spectral, TED, TED++) yield only marginal robustness gains (FDER ≈ 0.54), and trigger-synthesis-based defenses (IMS) achieve similarly near-neutral FDER (best ≈ 0.51), despite comparable MAEC . This suggests that a common bottleneck may arise under channel-subset TSF poisoning, where attackers typically poison only a subset of channels: sample-level criteria are dominated by non-poisoned variables; while trigger syn4
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
MAEP by only 1.58× with a 7.72% MAEC increase on PEMS03 and still requires clean data. These trends persist across datasets and attacks, as shown in Appendix G.1. Moreover, TSF models are often deployed in continuous real-time settings (Kim et al., 2025; Lin et al., 2024), where inference-time checks can introduce substantial overhead. Together with Insight 3.4, these observations motivate our focus on training-phase defense, which incurs no inferencetime overhead; we leave the development of efficient TSF inference-time defenses for future work.
thesis optimized over all channels receives diluted gradients, leading to “smeared” reconstructions. Consistently, Figure 2 shows that neighborhood distance (Section 4) statistics differ sharply between clean and poisoned channels, indicating that this measure is inherently channel-dependent. Insight 3.2: Defenses relying primarily on training-loss criteria are unreliable and fail to safeguard TSF models against backdoor attacks. Training-loss-only defenses (ABL, ESTI) fail to safeguard TSF models, with an average FDER of 0.497. Figure 3 (FEDformer) shows poisoned-sample losses quickly converging to clean-sample losses within the first few epochs, weakening the early-loss separation signal these methods depend on. This behavior may stem from TSF’s continuous regression objective (rather than an argmax-based discrete target), which encourage poisoned windows to achieve low loss, while overlapping input-output windows introduce affected hard samples, further blurring loss-based partitioning.
4. T IME G UARD Motivated by the partial success of fine-tuning and intraining baselines (Section 3), we propose T IME G UARD, an in-training defense against TSF backdoor attacks that constructs and maintains a channel-wise training pool without requiring any prior clean subset. The key idea is to refactor multivariate TSF training from a sample-level decision into a time × channel-wise decision (Section 4.1), since TSF backdoors often corrupt only a subset of channels (Lin et al., 2024). T IME G UARD then constructs and maintains per-channel reliable pools throughout training process via time-aware criteria (Section 4.2 and Section 4.3).
Insight 3.3: Fine-tuning-based and in-training modelagnostic defenses provide partial mitigation against TSF backdoor attacks, yet require a clean subset. Fine-tuning-based defenses (Fine-tuning, Fine-pruning, NAD) and the in-training model-agnostic defense (PDB) provide partial mitigation, achieving FDER > 0.6 on average across the two attacks. Compared to fine-tuning-based defense, PDB performs best (FDER = 0.666), suggesting that model-agnostic in-training intervention can be more effective than post-hoc repair. However, these methods all assume access to a verified clean subset, which is costly to obtain in time series domain (Lin et al., 2024).
4.1. Channel-wise Reliable Pool Training Many existing defenses (Li et al., 2021a; Huang et al., 2022; Gao et al., 2023a; Shen et al., 2025) adopt a sample-level formulation that discards suspected poisoned forecasting windows and trains on the remaining data. This assumption breaks in multivariate TSF, where backdoor injection often modifies only a subset of channels (Lin et al., 2024), making it wasteful to discard entire windows. Channel-wise objective. Given the training set D, we treat each channel objective independently. Particularly, for channel c, define the channel-wise window set D(c) = (c) (c) (c) (c) {(xt,h , xt,f )}, where xt,h ∈ RLin and xt,f ∈ RLout are the history and future windows. The full channel-wise win(c) (c) (c) dow sample is xt := [xt,h ; xt,f ]. We maintain a per-
Insight 3.4: Inference-time defenses offer marginal detection with high inference overhead in TSF. Inference-time defenses (STRIP, TeCo, IBD-PSC) provide only marginal detection after TSF adaptation, achieving just 0.551 AUROC and 0.559 F1 on the best method, TeCo, despite our attempts for time-aware perturbations and augmentations. Moreover, they impose heavy overhead (4–100×), increasing latency from ∼ 2s to > 200s, makes those impractical for real-time TSF systems (Fan & McDonald, 1994).
(c)
channel reliable pool Drel ⊆ D(c) and an unreliable pool (c) (c) Dunrel = D(c) \ Drel . We further introduce a binary mask mt,c ∈ {0, 1} indicating whether timestamp t for channel c is currently included in the reliable pool. The forecaster is trained by minimizing the masked empirical loss:
Summary. Our evaluation shows inconsistent effectiveness of existing TSF defenses, which we attribute to two TSF-specific failure modes: (1) Data Entanglement (Insights 3.1, 3.4), where channel-subset poisoning and temporal coupling dilute backdoor signals and undermine channelagnostic filtering, trigger synthesis, and inference-time detection; and (2) Task-Formulation Shift (Insight 3.2), where TSF’s regression objective and overlapping windows collapse training-loss-based separation. While fine-tuning and model-agnostic in-training baselines provide partial mitigation (Insight 3.3), the best baseline (PDB) improves
P 1 (c) (c) t,c mt,c ℓ(fθ (Xt,h ), xt,f ), m t,c t,c
Ldef (θ; m) = P
(3) (c) where fθ (·) is the prediction for channel c and ℓ(·, ·) is the forecasting loss. The key challenge is to construct and pro(c) gressively update mt,c so that Drel has high precision (few poisoned windows) while preserving sufficient diversity to maintain clean forecasting performance. For notational simplicity, we omit the channel superscript (c) below. 5
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Stage I: Time-aware Reliable Pool Initialization
𝒟
Stage II: Distance-Regularized Loss Selection
𝒟
Reverse-Consistency Filtering (RCF)
(Sliding Windows)
Train Tb epochs
𝒃𝝓
Losses on 𝒟
RCF
Distance-Regularized Loss Selection (DRLS)
(𝒟!"# ∪ 𝒟$%!"# ) 𝒟!"#
𝒟'()
Repeat T2 (after warm-up T1) Losses on candidates
Train on 𝒟$%&
𝒇𝜽
Loss Selection
𝒟!"# ← 𝒟'() ∩ 𝒟*+) Neighborhood Diversity Filtering (NDF) Neighbors: 𝒟
NDF
Reverse-Consistency Filtering (RCF) Samples with Loss ≤ Threshold
Threshold
X 𝒟$%!"# ← 𝒟 ∖ 𝒟!"#
𝒟$%!"#
𝒟*+)
NDF
,-#. 𝒟*+)
Update: 𝒟$%& ← 𝒟+'/0 , 𝒟"#$%& ← 𝒟 ∖ 𝒟+'/0
Legend
Neighborhood Diversity Filtering (NDF) Current Sample
Neighbor Candidate
Samples with Distance ≥ Threshold
Poisoned Sample Affected Sample
𝒟*+)
Distance
Loss
Neighborhood Distance
Neighbors from 𝒟/𝒟"#$%& Score on 𝒟
Clean Sample
Threshold
𝒟'()
Training Loss from 𝑏!
Neighbors: 𝒟"#$%&
Neighborhood Distances on 𝒟
𝒟!"#
Reliable Pool
𝒟$%!"#
Unreliable Pool
𝑏& / 𝑓'
Backcaster/ Forecaster
Figure 4. Overview of T IME G UARD. Stage I forms the reliable pool Drel by intersecting the subsets selected by Reverse-Consistency Filtering (RCF) and Neighborhood Diversity Filtering (NDF). Stage II trains fθ while progressively updating Drel via Distance-Regularized Loss Selection (DRLS) to prevent re-admitting correlated poisoned windows. All pools and filtering criteria operate in a channel-wise manner.
Pipeline overview. T IME G UARD instantiates and updates mt,c via a two-stage channel-wise procedure, as summarized in Figure 4. In Stage I: Time-aware Reliable Pool Initialization (Section 4.2), we construct a conservative, highprecision initial reliable pool by intersecting samples selected by two complementary time-aware criteria: ReverseConsistency Filtering (RCF) from a learning-behavior perspective and Neighborhood Diversity Filtering (NDF) from a temporal-structure perspective. In Stage II: DistanceRegularized Loss Selection (Section 4.3), we progressively update the reliable pool using Distance-Regularized Loss Selection (DRLS), which regularizes loss-based admission with neighborhood diversity to avoid re-including correlated, low-loss poisoned windows. Throughout training, the forecaster fθ is trained with the masked objective in Equation 3, and the full algorithm is given in Appendix D.1.
loss alone to separate samples is unreliable in TSF. We instead exploit a temporal asymmetry of TSF backdoors: the injected dependency is designed for the forecasting direction (history → future), but it does not enforce a consistent reverse dependency (future → history) (Lin et al., 2024). This mismatch makes reverse reconstruction less compatible with the backdoor dependency. RCF operationalizes this via an auxiliary backcasting task. We train a backcaster bϕ (Hyndman & Athanasopoulos, 2018) (using the same architecture as fθ ) for a small number of Tb epochs to reconstruct the flipped history window from the flipped future window. Let Flip(·) denote temporal reversal along the time axis. The reverse-consistency loss is: Lrcf (xt ) = ℓ(bϕ (Flip(Xt,f )), Flip(xt,h )).
(4)
We then select samples with relatively low reverseconsistency loss using a quantile threshold ΓRCF (the αquantile):
4.2. Time-aware Reliable Pool Initialization In Stage I, we initialize a high-precision yet conservative reliable pool without any clean reference set. Rather than maximizing recall, this stage aims to provide a trustworthy starting point for subsequent training and prevent early backdoor reinforcement. We therefore apply two complementary criteria and intersect their selections to form Drel .
DRCF = {xt | Lrcf (xt ) ≤ ΓRCF }.
(5)
Neighborhood diversity filtering (NDF). We now introduce the temporal-structure criterion used both in this stage and in the following stage. We begin by analyzing the conditions under which a TSF backdoor succeeds, drawing on NTK-inspired kernel analyses (Jacot et al., 2018) and previous backdoor studies (Guo et al., 2022; Xian et al., 2023).
Reverse-consistency filtering (RCF). As shown in Figure 3 and Table 1, using the forecaster’s forward training 6
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 3. Main results of backdoor defense against TSF backdoor attacks on PEMS03. Best and second results are bold and underline. Lower MAEC indicates better performance, while higher MAEP and FDER are preferred. We report performance averaged across the three forecasting models. Full per-model results and visualization examples are provided in Appendix G.1 and Appendix H, respectively. Attack → Defense ↓
MAEC ↓
Random MAEP ↑
FDER ↑
MAEC ↓
No Defense Spectral (Tran et al., 2018)
17.634 18.389
17.772 18.356
– 0.502
17.583 18.765
14.683 14.027
TED (Mo et al., 2024) TED++ (Le et al., 2025) Fine-tuning (Gu et al., 2019) Fine-pruning (Liu et al., 2018) NAD (Li et al., 2021b) IMS (Dunnett et al., 2025)
18.434 19.197 19.003 19.020 18.795 19.239
20.063 19.184 30.909 31.643 26.809 17.731
0.528 0.499 0.625 0.633 0.600 0.466
18.785 18.706 18.837 19.073 18.539 18.521
ABL (Li et al., 2021a) PDB (Wei et al., 2024)
19.637 18.630
19.104 54.690
0.493 0.693
ESTI (Yu et al., 2025) T IME G UARD
19.910 17.928
17.186 104.677
0.454 0.868
MAEC ↓
BackTime MAEP ↑
FDER ↑
– 0.475
17.607 18.666
14.201 15.245
– 0.539
13.984 13.445 22.479 23.543 20.297 14.570
0.473 0.473 0.641 0.647 0.614 0.479
18.606 18.565 18.934 18.686 18.584 18.418
13.953 14.541 18.196 19.736 18.158 14.351
0.495 0.513 0.594 0.623 0.600 0.509
18.649 19.512
15.055 26.014
0.501 0.652
18.761 18.967
14.481 22.397
0.509 0.639
18.793 17.628
14.684 57.759
0.475 0.847
19.219 18.048
15.897 39.303
0.532 0.808
where x̄i,ω denotes the weighted mean of xi under weights ω as follows: P (τ − Lin )2 τ ωτ xi [τ ] x̄i,ω = P , ωτ = exp − . 2σ 2 τ ωτ (7) We fix σ = 2 in all experiments and define the induced distance dω (xi , xj ) = 1 − rω (xi , xj ). Let NK (i) be the indices of the K nearest neighbors of xi under dω . The neighborhood distance score is: 1 X S(xi ) = dω (xi , xj ). (8) K
This analysis motivates our neighborhood diversity criterion, which we formalize below. Theorem 4.1 (TSF Backdoor Success Bound). Let x := xt,h denote a triggered test input window, and consider a TSF predictor ŷ(x) approximated by a Nadaraya– Watson kernel regressor trained on Np poisoned samples (x′j , T (x′j )) and Nbg background samples (xi , yi ) with an RBF kernel K(u, v) = exp(−γ∥u − v∥22 ), where xi := xi,h and yi := xi,f . Define ε := maxi K(x, xi ) and PNp σp2 (x) := N1p j=1 ∥x−x′j ∥22 . Assume (i) ∥yi −T (x)∥2 ≤ M for all background samples, and (ii) T (·) is locally LipsNp chitz with constant LT on a neighborhood of {x}∪{x′j }j=1 . Then Nbg M ε + LT σp (x). ŷ(x) − T (x) 2 ≤ Np exp − γ σp2 (x)
j∈NK (i)
NDF criterion. To promote temporal-structure diversity and reduce the risk of selecting poisoned windows, NDF prioritizes samples with larger neighborhood distance. Concretely, we select the top α fraction with the highest scores:
Proof. Deferred to Appendix C. Remark 4.2. The bound decreases as poisoned inputs concentrate around the triggered window (small σp (x)), which increases their kernel weight. Thus, successful TSF backdoors tend to induce a tight, highly similar cluster of poisoned input windows and consequently highly similar poisoned input–output windows. For instance-normalized windows, squared Euclidean distance is proportional to 1 − ρ(·, ·) (Pearson correlation) (Berthold & Höppner, 2016), motivating our correlation-based neighborhood distance for identifying more diverse samples as reliable candidates.
DNDF = {xt | S(xt ) ≥ ΓNDF },
(9)
where ΓNDF is the (1 − α)-quantile of {S(xi )}. Empirically, Figure 2 shows that poisoned samples exhibit abnormally smaller neighborhood distances in poisoned channels, consistent with the similarity concentration implied by Theorem 4.1. Finally, we obtain the initial reliable pool by intersecting the two criteria: Drel = DRCF ∩ DNDF . 4.3. Distance-Regularized Loss Selection After initializing Drel , T IME G UARD enters Stage II and progressively updates the reliable pool during training. A key risk in TSF is that poisoned windows may become indistinguishable from clean windows under loss-only criteria as training proceeds. We therefore regularize loss-based selection with a neighborhood-diversity constraint, which maintains forecasting performance while avoiding the reinclusion of highly correlated poisoned windows.
Gaussian-weighted Pearson-correlation neighborhood distance. We measure temporal similarity using a Gaussianweighted Pearson correlation that emphasizes the transition region between history and future. The weighted correlation between two window samples xi and xj is: xi [τ ] − x̄i,ω xj [τ ] − x̄j,ω q 2 P 2 , P τ ωτ xi [τ ] − x̄i,ω τ ωτ xj [τ ] − x̄j,ω P
rω (xi , xj ) = q
FreqBack-TSF MAEP ↑ FDER ↑
τ ωτ
cand DDRLS = {xt ∈ DNDF | L(xt ) ≤ ΓDRLS }.
(6) 7
(10)
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 4. Defense performance across PEMS03, Weather, and ETTm1 datasets under Random and BackTime attacks. Attack → Defense ↓
Random
Attack →
BackTime
MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense 17.634 PEMS03 PDB (Wei et al., 2024) 18.630 T IME G UARD 17.928
17.772 54.690 104.677
– 0.693 0.868
17.607 18.967 18.048
14.201 22.397 39.303
– 0.639 0.808
No Defense 11.210 Weather PDB (Wei et al., 2024) 12.305 T IME G UARD 10.587
14.991 91.237 177.583
– 0.841 0.942
10.768 11.732 10.716
15.913 56.439 66.534
– 0.827 0.874
No Defense ETTm1 PDB (Wei et al., 2024) T IME G UARD
1.059 2.972 6.481
– 0.766 0.881
1.114 1.274 1.268
0.805 1.422 1.443
– 0.648 0.652
1.144 1.230 1.235
MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense T IME G UARD
17.634 17.928
17.772 104.677
– 0.868
17.607 18.048
14.201 39.303
– 0.808
w/o Channel-wise w/o NDF w/o RCF w/o NDF+RCF w/o DRLS
18.320 18.581 18.063 18.336 19.748
16.145 104.457 104.405 91.780 76.442
0.478 0.853 0.865 0.852 0.607
19.068 18.418 18.608 18.273 20.081
14.925 38.349 39.612 38.560 22.918
0.507 0.795 0.796 0.799 0.586
FDER
BackTime
Defense ↓
MAEC MAEP FDER
Random
FDER
Dataset
Table 5. Ablation study on PEMS03 under Random and BackTime attacks. Full results are provided in Appendix G.2.
K
Figure 5. Hyperparameter analysis of pool size parameters α and β in T IME G UARD on the PEMS03 dataset under BackTime attack.
Figure 6. Hyperparameter analysis of K and π in T IME G UARD on the PEMS03 dataset under BackTime attack.
After T1 epochs of training on the initial reliable pool, T IME G UARD trains fθ for a further T2 epochs while progressively updating Drel ← DDRLS via Equation 10; the pool expansion ratio γ starts from α and is capped at β of the full dataset.
relative improvement in MAEP and a 6.09% relative reduction in MAEC , with average FDER of 0.841 across attacks. Notably, these gains require no additional clean data. Permodel results are provided in Appendix G.1. Generalization on different datasets. As shown in Table 4, T IME G UARD consistently improves robustness under both Random and BackTime across all three datasets, achieving FDER above 0.65 in all settings. On Weather, T IME G UARD also slightly improves clean forecasting accuracy over the undefended model (3.02% on average), suggesting that neighborhood-distance-based criteria can act as a regularizer for better generalization. On ETTm1, T IME G UARD incurs a small drop in clean performance but still delivers strong robustness without initial clean data unlike PDB.
5. Experiments We follow the datasets, attacks, and evaluation protocol in Section 3.1. For T IME G UARD, we set α=0.2 and β=0.5, and adopt a linear schedule for the clean-pool ratio γ in Stage II and grid-search π ∈ {1.25, 1.5} and K ∈ {20, 32}. We train fθ with Adam (Kingma, 2014) for T1 =10 epochs in Stage I and T2 =90 epochs in Stage II, and train the backcaster bϕ for Tb =10 epochs. Additional details are in Appendix F.6, further detailed analyses are deferred to Appendix G.6–G.8. By default, we present main results on PEMS03 and report results on other datasets in the corresponding appendix. Our code is available at https: //github.com/qducnguyen/TimeGuard.
Comprehensive defense performance, including generalization across model architectures, large TSF foundation models, forecasting horizons, poisoning rates, attack patterns, and challenging datasets with nonstationarity, strong distribution shifts, large scale, and count-valued variables, is deferred to Appendix G.1. Overall, T IME G UARD consistently achieves the best defense performance across diverse TSF attack settings and challenging scenarios. Notably, T IME G UARD remains effective even in the extreme full-channel poisoning setting, e.g., ηS = 1.0, achieving FDER of 0.748. Furthermore, T IME G UARD also transfers to an LLM-based forecaster (Liu et al., 2024c), yielding at least a 5.14× gain in MAEP with only a 3.8% change in clean MAEC .
5.1. Main Results Robustness against state-of-the-art attacks. As shown in Table 3, averaged over three models, T IME G UARD consistently mitigates all attacks, improving MAEP to at least 39.3 (a minimum relative gain of 2.76x) while keeping clean MAEC within 5% of the undefended model. This indicates strong robustness to recent TSF backdoor attacks. Robustness against recent BadTime attack (Xiang et al., 2025) and per-model results are provided in Appendix G.1.
5.2. Analysis
Comparison with state-of-the-art defenses. Table 3 also shows that T IME G UARD achieves the best overall tradeoff among previous training-phase defenses. Compared to the strongest baseline PDB, T IME G UARD yields a 1.96x
Ablation study. We ablate T IME G UARD under Random and BackTime to quantify each design component’s contribution. As shown in Table 5, removing the channel-wise 8
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 6. Training time (seconds ↓) of in-training backdoor defenses on the PEMS03 dataset. “No Defense” denotes standard training on the poisoned data without any defense. Best results are in bold. Model → Defense ↓
Table 7. Defense performance of T IME G UARD under BackTime and adaptive attacks on PEMS03 dataset, averaged over three models. Best results under adaptive attack are in bold.
SimpleTM FEDformer TimesNet AVERAGE
No Defense
1621
2340
2442
2134
ABL (Li et al., 2021a) PDB (Wei et al., 2024) ESTI (Yu et al., 2025) T IME G UARD
740 2378 5563 2454
1409 3441 10347 3411
2038 3399 11253 4250
1395 3073 9054 3372
Attack
Defense
MAEC ↓
MAEP ↑
FDER ↑
BackTime
No Defense T IME G UARD
17.607 18.048
14.201 39.303
– 0.808
Adaptive
No Defense T IME G UARD T IME G UARD w/o NDF T IME G UARD w/o DRLS
18.791 18.438 18.564 20.863
15.343 30.575 29.695 19.026
– 0.744 0.739 0.543
troduces a much larger overhead, averaging 4.24×, but remains ineffective against the TSF backdoor attacks. With no additional inference-time overhead, T IME G UARD remains practical against TSF backdoor attacks. We provide details of our efficient implementation of T IME G UARD and the running time on large TSF models in Appendix G.4 and G.1.
formulation causes the defense to fail (FDER = 0.493), underscoring the need to match the channel-subset granularity of TSF attacks. NDF and RCF are critical in Stage I for constructing a high-precision reliable pool and preventing early absorption of poisoned samples, as reflected by MAEP . Replacing DRLS with loss-only selection substantially degrades performance, reducing FDER by 28% on average. These results underscore the necessity of distance-aware selection for both clean generalization (MAEC ) and robustness (MAEP ). Overall, the components contribute synergistically to T IME G UARD’s effectiveness. Additional per-model ablation results are provided in Appendix G.2.
Potential adaptive attacks. We consider a worst-case adaptive scenario in which the attacker extends the state-of-theart BackTime attack (Lin et al., 2024) by (i) using a welltrained backcaster bϕ as a regularizer to encourage reverse consistency and (ii) explicitly penalizing high correlation among poisoned samples to evade our neighborhood-based criterion. As shown in Table 7, this adaptive attack attains 18.791 MAEC and 15.343 MAEP , slightly worse than the original BackTime attack. This is consistent with our analysis in Theorem 4.1, which suggests that successful TSF backdoor attacks benefit from tight, highly similar clusters of poisoned input samples. Under this adaptive threat, T IME G UARD still remains effective, achieving 18.438 MAEC , 30.575 MAEP , and 0.744 FDER.
Influence of α and β. Figure 5 shows a clear trade-off between clean performance (MAEC ) and robustness (MAEP , FDER) as the pool sizes vary under BackTime. Extremely small or large β either admits too few clean samples or incorporates too many poisoned samples, both of which reduce FDER. Similarly, a small α yields an insufficiently reliable initial pool for Stage II, leading to worse MAEC , MAEP , and FDER. Empirically, α ∈ [0.15, 0.25] and β ∈ [0.5, 0.7] provide the best balance, achieving the highest FDER, exceeding 0.8.
We further evaluate ablations that remove the neighborhoodbased components, namely w/o NDF and w/o DRLS, under this adaptive attack. Removing NDF slightly reduces FDER to 0.739, whereas removing DRLS causes a much larger drop in FDER to 0.543. These results indicate that neighborhood-based cues remain useful even under this challenging adaptive setting. More implementation details and per-model ablation results are provided in Appendix G.5.
Influence of K and π. With α=0.2 and β=0.5, we study the neighborhood size K and scaling factor π. As shown in Figure 6, T IME G UARD is largely insensitive to K, with FDER staying in a narrow range (0.805–0.809). In contrast, overly large π tends to narrow the candidate set and reduce diversity, increasing the risk of admitting poisoned samples during Stage II. We thus recommend π ≤ 1.5. Full permodel results, hyperparameter sensitivity analyses across different datasets and attacks, and analyses of other hyperparameters are provided in Appendix G.3.
6. Conclusion Our paper presents the first systematic study of defenses against TSF backdoor attacks. We first expose key failure modes of existing classification defenses in TSF stemming from data entanglement and task-formulation shift. To address these gaps, we propose T IME G UARD, a novel backdoor defense for TSF. Specifically, T IME G UARD performs channel-wise reliable pool training and leverages reverse consistency and temporal pattern concentration in poisoned TSF data to initialize and progressively refine reliable pools. Extensive experiments validate T IME G UARD’s effectiveness and generalization. Overall, our results emphasize the need for more robust and trustworthy forecasting systems. Limitations and future work are discussed in Appendix I.
Efficiency analysis. With our implementation, memory footprints are the same across methods; we therefore focus on the wall-clock training time of in-training defenses. Overall, Table 6 shows that T IME G UARD incurs a 1.58× training-time overhead compared with vanilla undefended training, averaging 3372s versus 2134s, mainly due to its multi-stage procedure and neighborhood-distance computations. This overhead is comparable to that of the current strongest baseline, PDB, which takes 3073s on average, while T IME G UARD achieves substantially stronger robustness against TSF backdoor attacks. In contrast, ESTI in9
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Acknowledgment
forecasting. In The Thirteenth International Conference on Learning Representations, 2025a.
This research / project is supported by the National Research Foundation, Singapore, and Cyber Security Agency of Singapore under its National Cybersecurity R&D Programme and CyberSG R&D Cyber Research Programme Office. Any opinions, findings and conclusions or recommendations expressed in these materials are those of the author(s) and do not reflect the views of National Research Foundation, Singapore, Cyber Security Agency of Singapore as well as CyberSG R&D Programme Office, Singapore.
Chen, Y., Shao, S., Huang, E., Li, Y., Chen, P.-Y., Qin, Z., and Ren, K. Refine: Inversion-free backdoor defense via model reprogramming. In International Conference on Learning Representations, 2025b. Chen, Y., Li, B., Yuan, Y., Qi, L., Li, Y., Zhang, T., Qin, Z., and Ren, K. Taught well learned ill: Towards distillationconditional backdoor attack. Advances in Neural Information Processing Systems, 38:156826–156860, 2026.
Impact Statement
Cheng, M., Yang, J., Pan, T., Liu, Q., Li, Z., and Wang, S. Convtimenet: A deep hierarchical fully convolutional model for multivariate time series analysis. In Companion Proceedings of the ACM on Web Conference 2025, pp. 171–180, 2025.
This work studies backdoor learning in time series forecasting (TSF) and proposes a defense against TSF backdoor attacks. It may improve the reliability of forecasting components in safety- or cost-critical pipelines and support the development of more robust and trustworthy time series machine learning. Potential negative impacts are primarily related to dual use: our analysis and evaluation may help adversaries design more evasive backdoors or adapt poisoning strategies. Accordingly, we report findings under explicit threat models and emphasize that defenses should be complemented by other standard security measures (e.g., data provenance) to provide more comprehensive protection.
Cho, Y. and Lee, J.-Y. Comres: Semi-supervised time series forecasting utilizing consensus promotion of multiresolution. In The Thirteenth International Conference on Learning Representations, 2025. Chou, E., Tramer, F., and Pellegrino, G. Sentinet: Detecting localized universal attacks against deep learning systems. In 2020 IEEE Security and Privacy Workshops (SPW), pp. 48–54. IEEE, 2020.
References
Ding, D., Zhang, M., Huang, Y., Pan, X., Feng, F., Jiang, E., and Yang, M. Towards backdoor attack on deep learning based time series classification. In 2022 IEEE 38th International Conference on Data Engineering (ICDE), pp. 1274–1287. IEEE, 2022.
Abbasimehr, H. and Paki, R. Improving time series forecasting using lstm and attention models. Journal of Ambient Intelligence and Humanized Computing, pp. 673–691, 2022. Berthold, M. R. and Höppner, F. On clustering time series using euclidean distance and pearson correlation. arXiv preprint arXiv:1601.02213, 2016.
Dunnett, K., Arablouei, R., Miller, D., Dedeoglu, V., and Jurdak, R. Backdoor mitigation via invertible pruning masks. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
Cai, H., Zhang, P., Dong, H., Xiao, Y., Koffas, S., and Li, Y. Toward stealthy backdoor attacks against speech recognition via elements of sound. IEEE Transactions on Information Forensics and Security, 19:5852–5866, 2024.
Fan, J. and McDonald, J. A real-time implementation of short-term load forecasting for distribution power systems. IEEE Transactions on Power Systems, 9(2):988– 994, 1994.
Chan, S.-H., Dong, Y., Zhu, J., Zhang, X., and Zhou, J. Baddet: Backdoor attacks on object detection. In European conference on computer vision, pp. 396–412. Springer, 2022.
Fanaee-T, H. Bike Sharing. UCI Machine Learning Repository, 2013. DOI: https://doi.org/10.24432/C5W894. Gao, K., Bai, Y., Gu, J., Yang, Y., and Xia, S.-T. Backdoor defense via adaptively splitting poisoned dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4005–4014, 2023a.
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018.
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th annual computer security applications conference, 2019.
Chen, H., Luong, V., Mukherjee, L., and Singh, V. Simpletm: A simple baseline for multivariate time series 10
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Gao, Y., Li, Y., Zhu, L., Wu, D., Jiang, Y., and Xia, S.-T. Not all samples are born equal: Towards effective cleanlabel backdoor attacks. Pattern Recognition, 139:109512, 2023b.
backdoor attacks. IEEE Transactions on Information Forensics and Security, 2025. Huang, H., Erfani, S. M., Li, Y., Ma, X., and Bailey, J. Detecting backdoor samples in contrastive language image pretraining. In The Thirteenth International Conference on Learning Representations, 2025a.
Gao, Y., Li, Y., Gong, X., Li, Z., Xia, S.-T., and Wang, Q. Backdoor attack with sparse and invisible trigger. IEEE Transactions on Information Forensics and Security, 19: 6364–6376, 2024.
Huang, K., Li, Y., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. In International Conference on Machine Learning, 2022.
Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. Badnets: Evaluating backdooring attacks on deep neural networks. Ieee Access, 7:47230–47244, 2019.
Huang, Y., Zhang, M., Wang, Z., Li, W., and Yang, M. Revisiting backdoor attacks on time series classification in the frequency domain. In Proceedings of the ACM on Web Conference 2025, pp. 1795–1810, 2025b.
Guo, J., Li, A., and Liu, C. AEVA: Black-box backdoor detection using adversarial extreme value analysis. In International Conference on Learning Representations, 2022.
Hyndman, R. J. and Athanasopoulos, G. Forecasting: principles and practice. OTexts, 2018.
Guo, J., Li, Y., Chen, X., Guo, H., Sun, L., and Liu, C. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference on Learning Representations, 2023.
Jacot, A., Gabriel, F., and Hongler, C. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018.
Guo, Z., Liang, S., Liu, A., and Tao, D. Copyrightshield: Spatial similarity guided backdoor defense against copyright infringement in diffusion models. arXiv preprint arXiv:2412.01528, 2024.
Jiang, Y., Ma, X., Erfani, S. M., and Bailey, J. Backdoor attacks on time series: A generative approach. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 392–403. IEEE, 2023.
Han, L., Chen, X.-Y., Ye, H.-J., and Zhan, D.-C. Softs: Efficient multivariate time series forecasting with seriescore fusion. Advances in Neural Information Processing Systems, 37:64145–64175, 2024.
Jiang, Y., Ma, X., Erfani, S. M., Li, Y., and Bailey, J. Endto-end anti-backdoor learning on images and time series. arXiv preprint arXiv:2401.03215, 2024. Kim, J., Kim, H., Kim, H., Lee, D., and Yoon, S. A comprehensive survey of deep learning for time series forecasting: Architectural diversity and open challenges. Artificial Intelligence Review, 2025.
Han, X., Absar, S., Zhang, L., and Yuan, S. Root cause analysis of anomalies in multivariate time series through granger causal discovery. In The Thirteenth International Conference on Learning Representations, 2025.
Kingma, D. P. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
Hayase, J., Kong, W., Somani, R., and Oh, S. Spectre: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning, pp. 4129–4139. PMLR, 2021.
Koffas, S., Pajola, L., Picek, S., and Conti, M. Going in style: Audio backdoors through stylistic transformations. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1–5. IEEE, 2023.
Hewage, P., Behera, A., Trovati, M., Pereira, E., Ghahremani, M., Palmieri, F., and Liu, Y. Temporal convolutional neural (tcn) network for an effective weather forecasting using time-series data from the local weather station. Soft Computing, pp. 16453–16482, 2020.
Kotowski, K., Shendy, R., Nalepa, J., Biecek, P., Wilczyński, P., Kaczmarek, A., Płudowski, D., Janicki, A., and Ntagiou, E. Trojan horse hunt in time series forecasting for space operations. arXiv preprint arXiv:2506.01849, 2025.
Hou, L., Feng, R., Hua, Z., Luo, W., Zhang, L. Y., and Li, Y. Ibd-psc: Input-level backdoor detection via parameteroriented scaling consistency. In International Conference on Machine Learning, pp. 18992–19022, 2024.
Kuang, J., Liang, S., Liang, J., Liu, K., and Cao, X. Adversarial backdoor defense in clip. arXiv preprint arXiv:2409.15968, 2024.
Hou, L., Luo, W., Hua, Z., Chen, S., Zhang, L. Y., and Li, Y. Flare: Towards universal dataset purification against 11
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Lai, G., Chang, W.-C., Yang, Y., and Liu, H. Modeling long-and short-term temporal patterns with deep neural networks. In The 41st international ACM SIGIR conference on research & development in information retrieval, pp. 95–104, 2018.
Lin, S., Lin, W., Wu, W., Zhao, F., Mo, R., and Zhang, H. Segrnn: Segment recurrent neural network for long-term time series forecasting. arXiv preprint arXiv:2308.11200, 2023.
Le, N., Zhang, L. Y., Liao, K., Pan, S., and Luo, W. Ted++: Submanifold-aware backdoor detection via layerwise tubular-neighbourhood screening. arXiv preprint arXiv:2510.14299, 2025.
Lin, W., Zhou, N., Wang, Y., Li, J., Xiong, H., and Liu, L. Backdoordm: A comprehensive benchmark for backdoor learning in diffusion model. In The Thirty-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2025.
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34:14900–14912, 2021a.
Lin, X., Liu, Z., Fu, D., Qiu, R., and Tong, H. Backtime: Backdoor attacks on multivariate time series forecasting. Advances in Neural Information Processing Systems, 37: 131344–131368, 2024.
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International conference on machine learning, 2021b.
Liu, A., Zhou, Y., Liu, X., Zhang, T., Liang, S., Wang, J., Pu, Y., Li, T., Zhang, J., Zhou, W., et al. Compromising embodied agents with contextual backdoor attacks. arXiv preprint arXiv:2408.02882, 2024a.
Li, Y., Jiang, Y., Li, Z., and Xia, S.-T. Backdoor learning: A survey. IEEE transactions on neural networks and learning systems, pp. 5–22, 2022a.
Liu, A., Liu, X., Zhang, X., Xiao, Y., Zhou, Y., Liang, S., Wang, J., Cao, X., and Tao, D. Pre-trained trojan attacks for visual recognition. International Journal of Computer Vision, 133(6):3568–3585, 2025a.
Li, Y., Zhong, H., Ma, X., Jiang, Y., and Xia, S.-T. Few-shot backdoor attacks on visual object tracking. In International Conference on Learning Representations, 2022b.
Liu, F., Jiang, S., Miranda-Moreno, L., Choi, S., and Sun, L. Adversarial vulnerabilities in large language models for time series forecasting. In International Conference on Artificial Intelligence and Statistics, pp. 4672–4680. PMLR, 2025b.
Li, Y., Huang, H., Zhao, Y., Ma, X., and Sun, J. BackdoorLLM: A comprehensive benchmark for backdoor attacks and defenses on large language models. In The Thirtyninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2025.
Liu, K., Dolan-Gavitt, B., and Garg, S. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pp. 273–294. Springer, 2018.
Li, Y., Zhu, M., Xia, S.-T., Li, Z., Qin, Z., and Tao, D. Rethinking the trigger of backdoor attacks: Towards physical backdoor threats. Pattern Recognition, pp. 113665, 2026.
Liu, M., Liang, S., Howlader, K., Wang, L., Tao, D., and Zhang, W. Natural reflection backdoor attack on vision language model for autonomous driving. arXiv preprint arXiv:2505.06413, 2025c.
Liang, J., Liang, S., Liu, A., and Cao, X. Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. International Journal of Computer Vision, pp. 1–20, 2025.
Liu, X., Li, M., Wang, H., Hu, S., Ye, D., Jin, H., Wu, L., and Xiao, C. Detecting backdoors during the inference stage based on corruption robustness consistency. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16363–16372, 2023a.
Liang, S., Liu, K., Gong, J., Liang, J., Xun, Y., Chang, E.-C., and Cao, X. Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning. arXiv preprint arXiv:2403.16257, 2024a.
Liu, X., Xia, Y., Liang, Y., Hu, J., Wang, Y., Bai, L., Huang, C., Liu, Z., Hooi, B., and Zimmermann, R. Largest: A benchmark dataset for large-scale traffic forecasting. Advances in Neural Information Processing Systems, 36: 75354–75371, 2023b.
Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., and Chang, E.-C. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 24645–24654, 2024b.
Liu, X., Hu, J., Li, Y., Diao, S., Liang, Y., Hooi, B., and Zimmermann, R. Unitime: A language-empowered unified model for cross-domain time series forecasting. In 12
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Proceedings of the ACM Web Conference 2024, pp. 4095– 4106, New York, NY, USA, 2024b. Association for Computing Machinery.
Radford, A., Wu, J., Child, R., Luan, D., Amodei, D., and Sutskever, I. Language models are unsupervised multitask learners. Open AI Blog, 2019.
Liu, Y., Qin, G., Huang, X., Wang, J., and Long, M. Autotimes: Autoregressive time series forecasters via large language models. Advances in Neural Information Processing Systems, 37:122154–122184, 2024c.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748–8763, 2021.
Liu, Z., Liu, X., Xu, S., Qiao, Y., Zhang, Y., and Cai, X. Beyond immediate activation: Temporally decoupled backdoor attacks on time series forecasting. arXiv preprint arXiv:2601.04247, 2026.
Ren, Z., Liang, S., Liu, A., and Tao, D. Iclshield: Exploring and mitigating in-context learning backdoor attacks. arXiv preprint arXiv:2507.01321, 2025.
Luo, C., Li, Y., Jiang, Y., and Xia, S.-T. Untargeted backdoor attack against object detection. In ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1–5. IEEE, 2023.
Shen, Y., Tan, X., Shen, D., Wang, M., and Wang, B. Biperspective splitting defense: Achieving clean-seed-free backdoor security. In Forty-second International Conference on Machine Learning, 2025.
Ma, Y., Guo, Z., Ren, Z., Tang, J., and Yin, D. Streaming graph neural networks. In Proceedings of the 43rd international ACM SIGIR conference on research and development in information retrieval, pp. 719–728, 2020.
Soi, Z. W., Zhu, C., Abiad, F., Shankar, A., Galjaard, J. M., Wang, H., and Chen, L. Y. Timewak: Temporal chainedhashing watermark for time series data. In The Thirtyninth Annual Conference on Neural Information Processing Systems, 2025.
Mo, X., Zhang, Y., Zhang, L. Y., Luo, W., Sun, N., Hu, S., Gao, S., and Xiang, Y. Robust backdoor detection for deep learning via topological evolution dynamics. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 2048–2066. IEEE, 2024.
Song, C., Lin, Y., Guo, S., and Wan, H. Spatial-temporal synchronous graph convolutional networks: A new framework for spatial-temporal network data forecasting. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 914–921, 2020.
Nematirad, R., Pahwa, A., and Natarajan, B. Are data embeddings effective in time series forecasting? Transactions on Machine Learning Research, 2025. ISSN 2835-8856.
Tang, R. R., Yuan, J., Li, Y., Liu, Z., Chen, R., and Hu, X. Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots. Advances in Neural Information Processing Systems, 36:73191– 73210, 2023.
Nie, Y., Nguyen, N. H., Sinthong, P., and Kalagnanam, J. A time series is worth 64 words: Long-term forecasting with transformers. In International Conference on Learning Representations, 2023.
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023.
Pialla, G., Ismail Fawaz, H., Devanne, M., Weber, J., Idoumghar, L., Muller, P.-A., Bergmeir, C., Schmidt, D. F., Webb, G. I., and Forestier, G. Time series adversarial attacks: an investigation of smooth perturbations and defense approaches. International Journal of Data Science and Analytics, 19(1):129–139, 2025.
Tran, B., Li, J., and Madry, A. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018. Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE symposium on security and privacy (SP), pp. 707– 723. IEEE, 2019.
Qiao, T., Wang, Y., Liu, X., Wu, S., Li, J., and Li, Y. Certssbd: Certified backdoor defense with sample-specific smoothing noises. IEEE Transactions on Information Forensics and Security, 2026.
Wang, M., Zhong, P., Wang, B., Wei, T., BAO, B., Guo, R., and Zhao, X. Trojanscope: Interpretable backdoor detection for time series forecasting. OpenReview, 2026. URL https://openreview.net/forum? id=yj9cg8rBcL. ICLR 2026 Conference withdrawn submission.
Qiu, X., Wu, X., Lin, Y., Guo, C., Hu, J., and Yang, B. Duet: Dual clustering enhanced multivariate time series forecasting. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pp. 1185–1196, 2025. 13
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Wang, S., Wu, H., Shi, X., Hu, T., Luo, H., Ma, L., Zhang, J. Y., and ZHOU, J. Timemixer: Decomposable multiscale mixing for time series forecasting. In The Twelfth International Conference on Learning Representations, 2024.
Xu, A., Wang, X., Zhang, Y., Wu, T., and Xian, X. Adversarial attacks on deep neural networks for time series prediction. In 2021 10th International Conference on Internet Computing for Science and Engineering, pp. 8–14, 2021.
Wang, X., Liang, S., Liao, D., Fang, H., Liu, A., Cao, X., Lu, Y.-l., Chang, E.-C., and Gao, X. Lie detector: Unified backdoor detection via cross-examination framework. arXiv preprint arXiv:2503.16872, 2025.
Xu, J., Zhang, W., Jing, X., Chen, S., Zhang, S., and Nie, J. Cpiri: Channel permutation-invariant relational interaction for multivariate time series forecasting. In The Thirteenth International Conference on Learning Representations, 2026a.
Wang, Y., Shi, H., Min, R., Wu, R., Liang, S., Wu, Y., Liang, D., and Liu, A. Universal backdoor attacks detection via adaptive adversarial probe. arXiv preprint arXiv:2209.05244, 2022.
Xu, S., Liang, S., Zheng, H., Liu, A., Wang, X., Luo, Y., Lin, F., Rutkowski, L., and Tao, D. Srd: Reinforcementlearned semantic perturbation for backdoor defense in vlms. In Proceedings of the AAAI Conference on Artificial Intelligence, pp. 11397–11405, 2026b.
Wei, S., Zha, H., and Wu, B. Mitigating backdoor attack by injecting proactive defensive backdoor. Advances in Neural Information Processing Systems, 37:80674– 80705, 2024.
Xu, X., Huang, K., Li, Y., Qin, Z., and Ren, K. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. In The Twelfth International Conference on Learning Representations, 2024.
Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., Zhu, M., Wang, R., Liu, L., and Shen, C. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. International Journal of Computer Vision, pp. 1–88, 2025a.
Xun, Y., Liang, S., Jia, X., Liu, X., and Cao, X. Robust anti-backdoor instruction tuning in lvlms. arXiv preprint arXiv:2506.05401, 2025. Yan, S., Xiong, Y., and Lin, D. Spatial temporal graph convolutional networks for skeleton-based action recognition. In Proceedings of the AAAI conference on artificial intelligence, 2018.
Wu, B., Zhu, M., Zheng, M., Zhu, Z., Wei, S., Zhang, M., Chen, H., Yuan, D., Liu, L., and Liu, Q. Defenses in adversarial machine learning: a systematic survey from the lifecycle perspective. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025b.
Yi, B., Huang, T., Chen, S., Li, T., Liu, Z., Chu, Z., and Li, Y. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In The Thirteenth International Conference on Learning Representations, 2025.
Wu, H., Xu, J., Wang, J., and Long, M. Autoformer: Decomposition transformers with auto-correlation for long-term series forecasting. Advances in neural information processing systems, 34:22419–22430, 2021.
Yu, H., Qi, L., Lin, W., Chen, J., Sun, H., and Sun, C. Backdoor defense via enhanced splitting and trap isolation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 1708–1717, 2025.
Wu, H., Hu, T., Liu, Y., Zhou, H., Wang, J., and Long, M. Timesnet: Temporal 2d-variation modeling for general time series analysis. In International Conference on Learning Representations, 2023.
Yue, Z., Wang, Y., Duan, J., Yang, T., Huang, C., Tong, Y., and Xu, B. Ts2vec: Towards universal representation of time series. In Proceedings of the AAAI conference on artificial intelligence, pp. 8980–8987, 2022.
Xi, Z., Pang, R., Ji, S., and Wang, T. Graph backdoor. In 30th USENIX Security Symposium (USENIX Security 21), pp. 1523–1540, 2021. Xian, X., Wang, G., Srinivasa, J., Kundu, A., Bi, X., Hong, M., and Ding, J. Understanding backdoor attacks through the adaptability hypothesis. In International Conference on Machine Learning, pp. 37952–37976. PMLR, 2023.
Zhai, T., Li, Y., Zhang, Z., Wu, B., Jiang, Y., and Xia, S.-T. Backdoor attack against speaker verification. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2560–2564. IEEE, 2021.
Xiang, K., Yang, H., Hao, M., Wang, H., Li, S., and Jiang, W. Badtime: An effective backdoor attack on multivariate long-term time series forecasting. arXiv preprint arXiv:2508.04189, 2025.
Zhang, K., Wen, Q., Zhang, C., Cai, R., Jin, M., Liu, Y., Zhang, J. Y., Liang, Y., Pang, G., Song, D., et al. Selfsupervised learning for time series analysis: Taxonomy, progress, and prospects. IEEE transactions on pattern 14
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
analysis and machine intelligence, 46(10):6775–6794, 2024a. Zhang, S., Roller, S., Goyal, N., Artetxe, M., Chen, M., Chen, S., Dewan, C., Diab, M., Li, X., Lin, X. V., Mihaylov, T., Ott, M., Shleifer, S., Shuster, K., Simig, D., Singh Koura, P., Sridhar, A., Wang, T., and Zettlemoyer, L. Opt: Open pre-trained transformer language models. arXiv preprint arXiv:2205.01068, 2022. Zhang, X., Liu, A., Zhang, T., Liang, S., and Liu, X. Towards robust physical-world backdoor attacks on lane detection. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 5131–5140, 2024b. Zhang, Y., Zhang, M., Zhang, Y., Lai, G., Liu, Y., Zhang, H., and Ma, S. Daily-aware personalized recommendation based on feature-level time series analysis. In Proceedings of the 24th International Conference on World Wide Web, pp. 1373–1383, 2015. Zheng, Q., Yao, Z., and Zhang, Y. St-rep: Learning predictive representations efficiently for spatial-temporal forecasting. In Proceedings of the AAAI Conference on Artificial Intelligence, 2025. Zhou, T., Ma, Z., Wen, Q., Wang, X., Sun, L., and Jin, R. Fedformer: Frequency enhanced decomposed transformer for long-term series forecasting. In International conference on machine learning, pp. 27268–27286, 2022. Zhu, M., Wei, S., Shen, L., Fan, Y., and Wu, B. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4466–4477, 2023. Zhu, M., Li, Y., Guo, J., Wei, T., Xia, S.-T., and Qin, Z. Towards sample-specific backdoor attack with clean labels via attribute trigger. IEEE Transactions on Dependable and Secure Computing, 2025. Zou, Y., Wang, Z., Klabjan, D., and Liu, H. Investigating hallucinations of time series foundation models through signal subspace analysis. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025.
15
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
A. Related Work A.1. Deep Models for Time Series Forecasting Time series forecasting (TSF) aims to predict future values of one or multiple variables based on their historical observations. With the rapid development of deep learning, a wide variety of TSF DNN architectures have been proposed to model complex temporal dependencies, nonlinear dynamics, and inter-variable dependencies. RNN-based methods (Abbasimehr & Paki, 2022; Hewage et al., 2020; Lin et al., 2023) capture sequential patterns through recursive state transitions, while CNN-based methods (Hewage et al., 2020; Cheng et al., 2025) employ dilated and causal convolutions to efficiently learn long-range temporal features. GNN-based approaches (Yan et al., 2018; Ma et al., 2020) explicitly represent inter-variable correlations by constructing spatio-temporal graphs, enabling information propagation across related variables. Recently, Transformer-based models (Nie et al., 2023; Zhou et al., 2022; Wu et al., 2023; Chen et al., 2025a) have achieved state-of-the-art TSF performance by leveraging self-attention to jointly capture global temporal dependencies and crossvariable interactions. MLP-based architectures (Han et al., 2024; Wang et al., 2024), built primarily on linear transformations, maintain high computational efficiency while still delivering strong forecasting accuracy. Currently, LLM-based models (Liu et al., 2024b;c) employ pre-trained LMMs as backbones and demonstrate impressive cross-domain generalization and zero-shot forecasting capability. However, the increasing model complexity and data dependency of modern TSF architectures introduce new trustworthiness concerns, including adversarial attacks (Xu et al., 2021; Pialla et al., 2025; Liu et al., 2025b), backdoor attacks (Lin et al., 2024; Kotowski et al., 2025), hallucination (Zou et al., 2025), and watermarking (Soi et al., 2025). In this work, we focus specifically on backdoor defenses for time series forecasting. A.2. Backdoor Attacks Backdoor attacks are typically implemented by injecting a small number of poisoned samples into the training set to implant hidden trigger-target associations (Li et al., 2022a). Once trained on such data, the model behaves normally on clean inputs but exhibits malicious behavior when the trigger appears, for example, classifying triggered samples into an attacker-specified target label. Such attacks have been extensively studies in computer vision (Gu et al., 2019; Gao et al., 2023b; 2024; Zhu et al., 2025; Chen et al., 2026; Li et al., 2026), speech recognition (Zhai et al., 2021; Koffas et al., 2023; Cai et al., 2024), object recognition (Li et al., 2022b; Chan et al., 2022; Luo et al., 2023), and graph learning (Xi et al., 2021), demonstrating that even a tiny poisoning ratio can yield high attack success while maintaining benign performance. In the time series domain, prior work has primarily examined backdoor attacks on classification tasks (Ding et al., 2022; Jiang et al., 2023; Huang et al., 2025b), where temporal triggers are injected into complete time series to manipulate predictions of physiological or activity signals. However, these studies are restricted to producing categorical output labels for entire time series, rather than finer-grained temporal segments. The first work to target TSF models, BackTime (Lin et al., 2024), embeds stealthy GNN-based trigger patterns with associated predefined target patterns in selected time step on the original training dataset via bi-level optimization. Following this, TBDA (Liu et al., 2026) introduces temporally delayed, variable-specific activations instead of immediate alignment, extending BackTime under a continuity assumption between trigger and target patterns. Meanwhile, BadTime (Xiang et al., 2025) studies long-term TSF and aims to train a backdoored model by using hybrid training strategy to select valuable poisoned samples and a decoupled backdoor objective leveraging distributed lag-aware triggers. Nevertheless, BadTime assumes a less practical threat model that requires full control over the training pipeline, whereas BackTime assumes only dataset-level control and employs more flexible, sample-dependent triggers. Although distributed lag-aware triggers are expressive, BadTime assumes unrealistic control over all input variables, which are typically distributed across multiple real-world data sources. Therefore, we adopt BackTime as our default threat model and leave a comprehensive evaluation under the BadTime-style threat model for future work. A.3. Backdoor Defense Backdoor defenses aim to mitigate or neutralize backdoor behaviors implanted during training or to detect such behaviors at inference. These methods can be categorized into four stages of the model life cycle (Wu et al., 2025a). Pre-training-stage defenses attempt to identify and remove poisoned samples before model training by analyzing training samples statistics or feature distributions to detect anomalous samples (Tran et al., 2018; Chen et al., 2018; Mo et al., 2024; Le et al., 2025;
16
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Hou et al., 2025). In-training-stage defenses aim to train clean models on poisoned datasets without backdoor injection, typically by reducing the influence of potentially poisoned samples through carefully designed training procedures (Li et al., 2021a; Tang et al., 2023; Gao et al., 2023a; Wei et al., 2024; Yu et al., 2025; Qiao et al., 2026). Post-training-stage defenses repair compromised models through structural modification or fine-tuning-based approaches (Liu et al., 2018; Wang et al., 2019; Li et al., 2021b; Dunnett et al., 2025; Xu et al., 2024; Chen et al., 2025b), Finally, inference-time defenses detect the presence of triggers at test time by measuring prediction consistency or entropy under different input perturbations or one input with multiple model variances (Liu et al., 2023a; Gao et al., 2019; Guo et al., 2023; Hou et al., 2024; Yi et al., 2025). Although these defenses have demonstrated effectiveness in classification and vision domains (Wu et al., 2025b), their applicability to the time series domain remains largely underexplored. In time series classification, one representative effort is E2ABL (Jiang et al., 2024), which extends ABL (Li et al., 2021a) and evaluates existing backdoor defenses on time series classification datasets. However, this work primarily focuses on empirical evaluation rather than proposing defenses that explicitly account for the temporal structure of time series inputs. Likewise, backdoor defenses for TSF remain largely unexplored. One notable concurrent effort in TSF backdoor defense is the competition associated with the “Assurance for Space Domain AI Applications” program, which aims to detect and reconstruct static trigger patterns in backdoored TSF models (Kotowski et al., 2025; Wang et al., 2026). However, this setting assumes access to clean models with the same architecture as the poisoned models, as well as clean datasets, and is limited to a subset of model architectures within the space operations domain. In this work, we conduct the first systematic study of representative backdoor defenses across the TSF model life cycle, spanning multiple domains and model architectures. We further introduce T IME G UARD, an in-training-stage defense specifically designed for TSF backdoors.
B. Further Analysis of Existing Backdoor Defenses Beyond the two fundamental issues in current backdoor defense settings for time series forecasting (TSF), namely data entanglement and task-formulation shift as discussed in Section 1, we further provide a detailed analysis of TSF-specific challenges that hinder the direct adaptation of existing defenses. We summarize these challenges in Section B.1. We then provide the rationale for selecting representative baselines in Section B.2 and clarify the practical attribute aspects of each defense in the TSF backdoor setting in Section B.3. B.1. TSF-Specific Challenges for Backdoor Defense Similar to backdoor attacks (Lin et al., 2024), defending TSF models against backdoor attacks presents several unique challenges compared to traditional backdoor defense in classification and generative models (Wu et al., 2025a; Li et al., 2025; Lin et al., 2025). These difficulties largely come from the intrinsic properties of forecasting. (i) The target outputs in TSF lie in a continuous space, making it infeasible for label-based defenses (Chen et al., 2018; Wang et al., 2019; Chou et al., 2020; Shen et al., 2025) that rely on either identifying poisoned classes or reconstructing potential triggers for each label in the output space. (ii) Samples in TSF exhibit strong temporal dependencies, where a single injected trigger or target pattern can propagate across overlapping input-output windows, contaminating subsequent forecasting steps and making it difficult to distinguish between clean and poisoned samples. (iii) Time series data are often uninterpretable to human; detecting abnormal fluctuations or poison patterns typically requires domain expertise (e.g., finance or healthcare), making manual inspection unreliable and the construction of a trusted clean dataset prohibitively expensive. (iv) TSF models are typically deployed in continuous real-time settings, where forecasts are generated sequentially and updated as new data arrive. Defense methods therefore must operate efficiently, limiting the practicality of inference-time detection methods that often require multiple forward passes (Gao et al., 2019; Liu et al., 2023a; Hou et al., 2024). Beyond these factors, the representational characteristics of TSF models also introduce further challenges for defense adaptation. (i) The heterogeneous representations produced by different deep TSF models (Kim et al., 2025) significantly hinder defense generalization. For instance, some models explicitly decompose time series into separate trend and seasonal components (Wu et al., 2023), while others rely on frequency-based transformations (Zhou et al., 2022) or channelindependent that processes each variable independently (Nie et al., 2023). As a result, their hidden representation spaces vary substantially across architectures, underscoring the need for model-agnostic (architecture-agnostic) defense design. (ii) Unlike classification or word embedding models (Radford et al., 2021), whose latent representations often align with semantically discrete concepts (e.g., object categories or word meanings), the semantics of hidden representations in TSF remain largely underexplored, further making representation-based defenses (Tran et al., 2018; Mo et al., 2024) unreliable under different DNNs. 17
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 8. Key attributes of defense methods against TSF backdoor attacks. Method
Defense Stage
No Additional Clean Data Required
No Internal Features Access Required
No Additional Inference Overhead
Time-Aware Design
Spectral (Tran et al., 2018) TED (Mo et al., 2024) TED++ (Le et al., 2025) Fine-tuning (Gu et al., 2019) Fine-pruning (Liu et al., 2018) NAD (Li et al., 2021b) IMS (Dunnett et al., 2025) ABL (Li et al., 2021a) PDB (Wei et al., 2024) ESTI (Yu et al., 2025) STRIP (Gao et al., 2019) TeCo (Liu et al., 2023a) IBD-PSC (Hou et al., 2024) T IME G UARD
Pre-training Pre-training Pre-training Post-training Post-training Post-training Post-training In-training In-training In-training Inference Inference Inference In-training
✓ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✗ ✗ ✗ ✓ ✗ ✓
✗ ✗ ✗ ✓ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✗ ✓
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✓ ✗ ✗ ✗ ✓
✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓
B.2. Rationale for Selecting Representative Defenses We evaluate 13 representative defenses spanning four stages of the model life cycle, following the taxonomy of BackdoorBench (Wu et al., 2025a). Specifically, our selection is guided by two criteria. (i) Representativeness: we include both classic methods (e.g., Spectral (Tran et al., 2018), Fine-pruning (Liu et al., 2018), ABL (Li et al., 2021a)) and recent advanced approaches (e.g., PDB (Wei et al., 2024), TED++ (Le et al., 2025), and ESTI (Yu et al., 2025)) that have shown effectiveness in classification or vision domains. (ii) Adaptation Feasibility: the method must be practical to adapt to TSF. Accordingly, we exclude algorithms that depend on discrete output spaces, such as those requiring enumeration of all target labels to detect poisoned samples (Chen et al., 2018; Shen et al., 2025), or access to poisoned labels (Shen et al., 2025), as well as methods relying on self- or semi-supervised learning frameworks (Huang et al., 2022; Gao et al., 2023a), which remain architecture-dependent and are not yet applicable to diverse TSF models (Zhang et al., 2024a; Cho & Lee, 2025). B.3. Key Practical Attributes for TSF Defenses To systematically compare these defenses, we examine four key attributes relevant to forecasting: (i) No Additional Clean Data Required: whether the method avoids dependence on a clean split, addressing the challenge of constructing trusted datasets for time series; (ii) No Internal Feature Access Required: whether the defense operates without access to intermediate activations or feature representations, reflecting model-agnostic applicability; (iii) No Additional Inference Overhead: whether the defense incurs extra computational cost during inference, which is critical for real-time forecasting deployments; and (iv) Time-Aware Design: whether the defense explicitly incorporates time-series characteristics. As summarized in Table 8, substantial differences emerge across defenses at different stages. Post-training-stage methods typically rely on additional clean data, while pre-training-stage defenses often require access to internal representations. Inference-time defenses, on the other hand, introduce notable inference overhead, limiting their deployment efficiency. Importantly, none of the existing defenses explicitly accounts for temporal dynamics, as they were all originally designed for static classification tasks. Motivated by these observations, we evaluate these defenses in the TSF setting in Section 3 and introduce T IME G UARD as a in-training time-aware backdoor defense in Section 4. We leave the development of efficient inference-time backdoor defenses for future work.
C. Theoretical Analysis of TSF Backdoor Success In this section, we provide a bound showing that successful and stealthy TSF backdoor attacks tend to induce highly similar (and thus highly correlated) poisoned input windows, motivating the design of T IME G UARD. For readability, we focus on a single channel so that each history window is a vector xt,h ∈ RLin and each future window is xt,f ∈ RLout . We denote a triggered test input by x := xt,h , background inputs by xi := xi,h with outputs yi := xi,f , and poisoned inputs by x′j . Setup. Following (Xian et al., 2023; Guo et al., 2022), we approximate a TSF predictor in a kernel regression regime (Jacot 18
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
et al., 2018). Assume all windows are instance-normalized during preprocessing. Let K(u, v) be an RBF kernel K(u, v) = exp − γ∥u − v∥22 , N
p with bandwidth γ > 0. The training set consists of Np poisoned samples Dp = {(x′j , yj′ )}j=1 and Nbg background samples
Nbg Dbg = {(xi , yi )}i=1 (e.g., containing clean and affected samples).
Attack mechanism and target mapping. In the threat model (Lin et al., 2024), the attacker inserts a trigger into the history window and enforces a patterned target in the future window. At the dataset level (multivariate notation), for an injection time t and attacked channel subset S: X[t − Ltgr : t, S] ← Gt ,
X[t : t + Lptn , S] ← X[t − Ltgr − 1, S] ⊕ P,
where Gt is a trigger pattern at timestep t and P is a fixed attack pattern template and ⊕ denotes element-wise addition (with broadcasting along time when needed). This produces sample-dependent target patterns because the baseline term X[t − Ltgr − 1, S] varies across samples. We abstract this behavior via a deterministic mapping T (·) at the window level. Definition C.1 (Backdoor Target Mapping). Let p denote the attack pattern template (aligned to the selected channel within P), and let b(x) extract a baseline value from an input window (e.g., the value immediately preceding the trigger, broadcast to match the target horizon). Define T (x) := b(x) ⊕ p. For a poisoned input x′j , its poisoned label is yj′ = T (x′j ). For a triggered test window x, the attacker aims for ŷ(x) ≈ T (x). Key quantities. For a triggered test input x, define the maximum similarity to background inputs: ε :=
max (xi ,yi )∈Dbg
K(x, xi ),
and define the poison dispersion around x: Np
σp2 (x) :=
1 X ∥x − x′j ∥22 , Np j=1
σp (x) :=
q
σp2 (x).
Intuitively, ε measures how strongly background samples can influence prediction at x, while σp (x) measures how tightly poisoned inputs concentrate around x. Theorem C.2 (TSF Backdoor Success Bound). Let ŷ(·) be the Nadaraya–Watson kernel regressor trained on Dbg ∪ Dp : PNbg ŷ(·) =
PNp
i=1 K(·, xi ) yi + PNbg i=1 K(·, xi ) +
′ ′ j=1 K(·, xj ) T (xj ) . PNp ′ j=1 K(·, xj )
Assume: 1. Bounded background deviation. For the triggered test window x, ∥yi − T (x)∥2 ≤ M for all (xi , yi ) ∈ Dbg . 2. Local Lipschitzness of T . There exists LT > 0 such that ∥T (u) − T (v)∥2 ≤ LT ∥u − v∥2
N
p for all u, v in a neighborhood of {x} ∪ {x′j }j=1 .
Then for the triggered test window x, ŷ(x) − T (x) 2 ≤
Nbg M ε + LT σp (x) . | {z } Np exp − γ σp2 (x) | {z } (II) target mismatch (I) background influence
19
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Proof. Let W (x) :=
Nbg X
Np X
K(x, xi ) +
i=1
K(x, x′j ),
Wp (x) :=
j=1
Np X
K(x, x′j ).
j=1
Subtract T (x) from ŷ(x) and regroup: PNbg ŷ(x) − T (x) =
i=1 K(x, xi ) yi − T (x)
PNp + j=1 K(x, x′j ) T (x′j ) − T (x) . W (x)
Taking norms and applying triangle inequality yields two terms. (I) Background influence. Using ∥yi − T (x)∥2 ≤ M and K(x, xi ) ≤ ε, Nbg X
K(x, xi ) yi − T (x)
i=1
≤ 2
Nbg X
K(x, xi ) ∥yi − T (x)∥2 ≤ Nbg M ε.
i=1
Nbg M ε . To lower bound Wp (x), let δj := ∥x − x′j ∥22 so Wp (x) K(x, x′j ) = exp(−γδj ). By Jensen’s inequality (since z 7→ e−γz is convex), Moreover, W (x) ≥ Wp (x), hence the term is upper bounded by
Np Np 1 X 1 X exp(−γδj ) ≥ exp − γ · δj = exp − γ σp2 (x) . Np j=1 Np j=1
Multiplying by Np gives Wp (x) =
Np X
exp(−γδj ) ≥ Np exp − γ σp2 (x) ,
j=1
which proves term (I). (II) Target mismatch. By Lipschitzness of T , ∥T (x′j ) − T (x)∥2 ≤ LT ∥x′j − x∥2 . Thus, Np X
K(x, x′j ) T (x′j ) − T (x)
j=1
Let wj := K(x, x′j )/Wp (x) so that wj ≥ 0 and PNp
′ ′ j=1 K(x, xj ) ∥xj − x∥2
Wp (x)
=
2
≤ LT
Np X
K(x, x′j ) ∥x′j − x∥2 .
j=1
P
j wj = 1. Then
Np X
v v u Np u Np uX uX ′ t ′ 2 wj ∥xj − x∥2 ≤ wj ∥xj − x∥2 = t wj δj ,
j=1
j=1
j=1
P
where the inequality is Cauchy–Schwarz. Now note that j wj δj is the expectation of δ under the Gibbs weights wj ∝ e−γδj . This expectation is non-increasing in γ and equals the uniform mean at γ = 0; therefore for γ > 0, Np X j=1
Hence
P
Np
wj δj ≤
1 X δj = σp2 (x). Np j=1
′ j wj ∥xj − x∥2 ≤ σp (x), proving term (II). Combining (I) and (II) completes the proof.
Remark C.3 (Connection to Correlation-based Neighborhood Distance in Section 4). For two z-normalized vectors u, v ∈ RLin , the squared Euclidean distance satisfies ∥u − v∥22 = 2 Lin 1 − ρ(u, v) , 20
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
where ρ(u, v) is the Pearson correlation. Defining dnb (u, v) := 1 − ρ(u, v) (or a weighted variant dnb (u, v) := 1 − ρw (u, v)), we obtain ∥u − v∥22 ∝ dnb (u, v) for normalized windows (up to a constant factor depending on Lin ), consistent with Berthold & Höppner (2016). PNp PNp Therefore, σp2 (x) = N1p j=1 ∥x − x′j ∥22 is proportional (up to constants) to N1p j=1 dnb (x, x′j ). Hence, requiring 2 small σp (x) corresponds to poisoned inputs forming a tight cluster under our neighborhood distance with high temporal correlation. Moreover, TSF backdoor attacks commonly rely on a shared attack-pattern template p, which makes poisoned input–output windows redundant and highly similar. Motivated by prior observations that time steps near the prediction boundary between input and output windows exert stronger influence on prediction manipulation (Lin et al., 2024; Xiang et al., 2025), we adopt a Gaussian-weighted Pearson correlation when computing dnb (·, ·), supporting our neighborhood diversity filtering in Section 4.2 and Section 4.3.
D. Method Details D.1. Training Algorithm Outline The pseudocode of the our proposed method T IME G UARD is listed as in Algorithm 1. D.2. Comparison with Distance-based Backdoor Defenses At a high level, T IME G UARD may appear related to prior distance-based backdoor defenses. However, most existing distance-based defenses typically operate in learned representation spaces and typically rely on a separability assumption between poisoned and clean samples (Chen et al., 2018; Tran et al., 2018; Hayase et al., 2021; Huang et al., 2025a). Such assumptions can be brittle even in standard vision settings, where representation-based filtering may break down under more challenging scenarios (e.g., source-specific or dynamic triggers) (Mo et al., 2024). The mismatch is further exacerbated in TSF: (i) forecasting is a regression task without discrete target classes for within-class clustering, (ii) TSF backdoors are often channel-subset, so the overall sample representation could remain close to clean, and (iii) heterogeneous internal representations across forecasting architectures make it difficult to apply a unified representation-space criterion. Consequently, clean/poison separation in learned activations is not a reliable primitive for TSF. In contrast, T IME G UARD uses distance in a fundamentally different way. Rather than measuring learned representations, we compute data-space neighborhood distances between instance-normalized channel-wise windows (equivalently, correlationbased distances) and use them to measure local temporal similarity concentration with theoretical support. The key signal is not global separability, but an abnormal neighborhood dispersion pattern induced by trigger and target patterns reuse: poisoned windows tend to exhibit unusually small distances to their nearest neighbors along the attacked channels, even when they remain mixed with clean windows overall. This distance cue is then fused with TSF-specific directional evidence (reverse consistency loss) to progressively construct a reliable pool during training, without requiring access to intermediate activations or assuming feature-space clustering structure.
E. Evaluation Metrics For training-phase defenses, we use two typical metrics: clean forecasting error (MAEC ), attack forecasting error (MAEP ). MAEC measures the Mean Absolute Error (MAE) between model’s output and ground-truth future values on clean inputs, reflecting natural forecasting ability. MAEP measures the MAE between model’s output and the target pattern when the input contain triggers, reflecting resistance against backdoor manipulation. A desirable defense should achieve a low MAEC while having a high MAEP following prior backdoor settings (Gao et al., 2023a; Yu et al., 2025). Taking both MAEC and MAEP into account, we further propose a new metric, Forecasting Defense Effectiveness Rating (FDER), adapted from the Defense Effective Rate (DER) originally proposed for classification models (Zhu et al., 2023). Unlike DER, which relies on accuracy-based metrics, FDER employs relative error-based measures more suitable for forecasting:
FDER =
max(0, ρMAEP ) − max(0, ρMAEC ) + 1 ∈ [0, 1], 2 21
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Algorithm 1 Pseudocode for T IME G UARD Input: training set D from poisoned series X ∈ RT ×C ; forecaster fθ ; backcaster epochs Tb ; Stage I epochs T1 ; Stage II epochs T2 ; init ratio α; max ratio β; neighbors K; candidate scaling factor π. Output: defended forecaster fθ . # Stage I: Time-aware Reliable Pool Initialization (Section 4.2) Initialize backcaster bϕ with the same architecture as fθ . for e = 1 to Tb do for all (Xt,h , Xt,f ) ∈ D do ϕ ← ϕ − ∇ϕ ℓ bϕ (Flip(Xt,f )), Flip(Xt,h )) end for end for for c = 1 to C do # RCF: Reverse-Consistency Filtering (c) Compute DRCF using ΓRCF as the α-quantile of reverse-consistency losses (Eq. 5). # NDF: Neighborhood Diversity Filtering Compute neighborhood distances S (c) (·) with D(c) as neighbors (Eq. 8). (c) Select DNDF using ΓNDF as the (1 − α)-quantile (Eq. 9). (c) (c) (c) (c) (c) Drel ← DRCF ∩ DNDF ; Dunrel ← D(c) \ Drel end for i h (c) (c) (c) Update mask mt,c ← 1 (xt,h , xt,f ) ∈ Drel for all (t, c). for e = 1 to T1 do for all (Xt,h , Xt,f ) ∈ D do θ ← θ − ∇θ Ldef (θ; m) (Eq. 3). end for end for # Stage II: Distance-Regularized Loss Selection (Section 4.3) for e = 1 to T2 do (e − 1) {Current target clean ratio (treat 0/0 as 0).} γ ← α + Tβ−α 2 −1 for c = 1 to C do # DRLS: Distance-Regularized Loss Selection (c) Compute S (c) (·) with Dunrel as neighbors (Eq. 8). (c)
cand Select candidate set DNDF using ΓNDF as the (1 − πγ)-quantile (Eq. 9). {top 100πγ% of D(c) } (c) cand(c) Update Drel using ΓDRLS as the (1/π)-quantile of losses over DDRLS (Eq. 10). {equivalent of 100γ% of D(c) } (c) (c) Dunrel ← D(c) \ Drel end for h i (c) (c) (c) Update mask mt,c ← 1 (xt,h , xt,f ) ∈ Drel for all (t, c).
for all (Xt,h , Xt,f ) ∈ D do θ ← θ − ∇θ Ldef (θ; m) (Eq. 3). end for end for
22
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
where the relative clean gain (ρMAEC ) and relative attack gain (ρMAEP ) are defined as: ρMAEC = 1 −
MAEund C , MAEC
ρMAEP = 1 −
MAEund P . MAEP
Here ρMAEC quantifies the relative increase in clean forecasting error (performance overhead), while ρMAEP quantifies the und relative increase in attack forecasting error (robustness gain) after defense. MAEund C and MAEP denote the clean and attack forecasting errors of undefended model. A higher FDER value indicates stronger defense effectiveness with smaller degradation of clean forecasting performance. For inference-time defenses, which aim to identify triggered input samples during prediction, following Liu et al. (2023a), we adopt two evaluation metrics: (i) the AUROC, which measures the trade-off between true and false detection rates, and (ii) F1 score, which measures the harmonic mean of precision and recall, reflecting the overall detection performance. Higher AUROC and F1 scores indicate stronger detection capability and more reliable inference-time defense performance. In our setting, benign means good forecasting on clean inputs (low MAEC ); malicious success means that triggered inputs are steered toward the attacker’s target (low MAEP ); and simply wrong means the model performs poorly in general, which is also reflected by high error on clean inputs. We also do not assume that poisoned TSF samples must always have globally distinct trajectories from benign ones, since both the trigger and target patterns are attacker-defined. When these patterns mimic common clean motifs, poisoned and clean samples can indeed become ambiguous. Therefore, defense success should not be judged by trajectory separability, but by whether a method preserves benign forecasting utility while disrupting malicious target alignment.
F. Experimental Protocol F.1. Environments All experiments are implemented in PyTorch 2.1.0+cu118 and run on a Linux 22.04.5 LTS server equipped with 4× NVIDIA RTX A6000 Ada GPUs. F.2. Dataset Description Table 9. Dataset statistics.
Dataset
# Timestamps
# Variables (channels)
PEMS03 Weather ETTm1
26208 52696 69680
358 21 7
We primarily evaluate T IME G UARD on three real-world multivariate forecasting benchmarks spanning traffic, meteorology, and energy systems: PEMS03 (Song et al., 2020), Weather (Wu et al., 2021), and ETTm1 (Zhou et al., 2022). Table 9 summarizes their basic statistics; we briefly describe each dataset below. • PEMS03. A traffic forecasting dataset built from Caltrans’ Performance Measurement System (PeMS) loop-detector data. We use 5-minute aggregated measurements from 358 sensors (Sep-Nov 2018). PeMS provides standard traffic signals such as flow, speed, and occupancy. • Weather. Hourly weather-station observations from NOAA NCEI Local Climatological Data, covering nearly 1,600 U.S. locations from 2010–2013. We forecast wet-bulb temperature using accompanying meteorological variables. • ETTm1. A 15-minute-resolution subset of the Electricity Transformer Temperature (ETT) collection, containing 7 channels (oil temperature as the target and 6 load-related variables) over roughly two years. We use the preprocessed versions of all datasets provided by TSLib1 , consistent with the data pipeline used in BackTime2 . 1 2
https://github.com/thuml/Time-Series-Library https://github.com/xiaolin-cs/BackTime
23
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
F.3. Forecasting Models To evaluate whether T IME G UARD and other defenses are model-agnostic, we primarily apply them to three representative forecasting backbones under backdoor attacks: • FEDformer (Zhou et al., 2022). A Transformer-based forecaster that combines seasonal–trend decomposition with frequency-domain modeling (e.g., Fourier bases) to capture global patterns efficiently.3 • TimesNet (Wu et al., 2023). A period-aware architecture that maps 1D sequences into structured 2D representations and applies an inception-style block to model temporal variations across discovered periods.4 • SimpleTM (Chen et al., 2025a). A lightweight multivariate forecasting baseline that tokenizes each channel via a stationary wavelet transform and models cross-channel dependencies with a simple interaction module.5 For each backbone, we use the authors’ official implementation and follow the default training configuration as closely as possible. When the released code provides multiple recommended settings (e.g., varying by dataset or prediction horizon), we adopt the most commonly used configuration. All exact hyperparameters for each model are provided in our code release. F.4. Attack Methods To assess how well each defense generalizes across different TSF backdoor strategies, we evaluate robustness under the following attacks: • BackTime (Lin et al., 2024). A state-of-the-art TSF backdoor attack that selects vulnerable timestamps and synthesizes sample-dependent triggers via a GNN-based generator, leveraging inter-variable correlations. We follow BackTime and constrain the trigger perturbation by a budget ∆tgr . • Random. A simple BadNets-inspired (Gu et al., 2019) baseline that injects a fixed random trigger shared across all poisoned timestamps. We sample the trigger from U[−∆tgr , ∆tgr ]. • FreqBack-TSF. An adaptation of FreqBack (Huang et al., 2025b) to forecasting that utilizes a learned universal trigger guided by frequency-domain analysis. Concretely, we replace BackTime’s sample-dependent GNN trigger generator with a single trainable trigger tensor and optimize it using FreqBack’s frequency-guided objective (frequency and regularization terms), together with the standard target-pattern construction loss. We estimate the frequency heatmap of the trigger position for each selected poisoned channel. Since the original paper does not specify the perturbation-norm weighting, we set λ=1 and keep all other hyperparameters consistent with the official implementation. In addition to the above three attacks, we report results for the Manhattan baseline from BackTime (Lin et al., 2024), which uses triggers that mimic common temporal patterns. Specifically, Manhattan retrieves segments closest to the target pattern under the Manhattan (L1) distance and uses the preceding window as the trigger. Unless otherwise specified, we follow the default BackTime setting with window lengths Lin =Lout =12, temporal injection rate ηT =0.03, and spatial injection rate ηS =0.3. We use the cone-shaped attack pattern by default following BackTime; details of the attack patterns are provided in Section F.5. F.5. Attack Patterns Cone-shaped Attack Pattern
Up-trend Attack Pattern
Up-and-down Attack Pattern 0.35
0.2
0.30
0.3
0.25
0.0
0.2
0.20 0.2
0
1
2
3
Time Step
4
5
6
0.15 0
1
2
3
Time Step
4
5
6
0
1
2
3
Time Step
4
5
6
Figure 7. Attack pattern shapes evaluated in this paper, covering diverse temporal trends as in BackTime (Lin et al., 2024). 3
https://github.com/MAZiqing/FEDformer https://github.com/thuml/TimesNet 5 https://github.com/vsingh-group/SimpleTM 4
24
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
To evaluate T IME G UARD under diverse attack scenarios, we consider three attack-pattern shapes P following the BackTime setup for a fair comparison (Lin et al., 2024). For each poisoned timestamp of the selected channel, the attacker injects the standardized attack pattern into the forecasting horizon. The three pattern shapes (cone, up-trend, and up-and-down) are illustrated in Figure 7. F.6. T IME G UARD Settings For T IME G UARD implementation, we follow the training pipeline of BackTime (Lin et al., 2024) as closely as possible to ensure a fair comparison. Unless otherwise specified, we use Adam (Kingma, 2014) with learning rate 1 × 10−4 for both the forecaster fθ and the backcaster bϕ , batch size 64, and SmoothL1Loss as the default training loss. We adopt the default input/output window lengths Lin =12 and Lout =12. To match BackTime’s default budget of 100 training epochs, we set Stage I and Stage II to T1 =10 and T2 =90 epochs, respectively. We additionally train the backcaster bϕ for Tb =10 epochs. We set the initial reliable-pool ratio to α=0.2 and the final ratio to β=0.5, and use a linear schedule for γ that increases from α to β throughout Stage II. We grid-search the scaling factor π ∈ {1.25, 1.5} and the neighborhood size K ∈ {20, 32}. We use a 6:2:2 train/validation/test split and report performance on the test set. F.7. Baseline Defenses and TSF Adaptation Since TSF-specific backdoor defenses remain limited, we adapt 13 representative defenses originally proposed for classification, spanning all four stages of the model life cycle and covering diverse defense paradigms (Wu et al., 2025a; Li et al., 2022a). For fairness, we start from each method’s official (or widely used) implementation and make only the minimal modifications required to support forecasting. In general, we replace accuracy-based criteria with MAE-based counterparts and substitute the entropy loss with a regression loss. For inference-time and input-transformation defenses, we tailor the perturbation/augmentation operators to time-series inputs; otherwise, we keep the original procedures unchanged. By default, we follow BackdoorBench implementations when available (Wu et al., 2025a); for methods not included, we adapt the authors’ original repositories as fair as possible. Below, we summarize the key adaptation choices and the settings that differ from the original defaults, grouped by life-cycle stage. Pre-training-stage defenses. • Spectral (Tran et al., 2018). Spectral detects poisons by SVD-based outlier scoring in learned representations within each label group, removing top-scoring points before retraining. For TSF, we use penultimate-layer sample representations, flatten them, obtain pseudo-labels via k-means, and apply the original per-cluster scoring/removal. We tune k ∈ {5, 10, 20} and use the best-performing setting. • TED (Mo et al., 2024). TED flags backdoor samples by tracking how a sample’s neighborhood structure evolves across layers: at selected layers, it records the rank of the nearest neighbor from the predicted group and uses the resulting rank trajectory for PCA-based outlier detection. For TSF, we assign pseudo-labels via k-means (as in Spectral) and compute rank trajectories within each cluster using flattened layer representations; we extract features from M evenly spaced layers, with M =20 for SimpleTM and M =5 for FEDformer/TimesNet due to memory limits, and tune k ∈ {5, 10, 20}. • TED++ (Le et al., 2025). TED++ extends TED by explicitly modelling a layer-wise tubular neighbourhood around each class’s hidden-feature submanifold, then applying Locally Adaptive Ranking (LAR) that assigns worst-case ranks to activations falling outside the tube. It aggregates the LAR ranks across layers into a trajectory and flags outliers using a PCA reconstruction-error test. For TSF, we use the same adaptation settings as TED. In-training-stage defenses. • ABL (Li et al., 2021a). ABL identifies suspicious easy-to-fit poisoned samples from training dynamics and then performs an unlearning stage to suppress their influence. For TSF, we replace the cross-entropy loss with its regression counterparts and otherwise follow the original procedure, using learning rate 10−4 for standard training and 10−5 for unlearning, which is the same as the TSF training pipeline of BackTime (Lin et al., 2024). • PDB (Wei et al., 2024). PDB is a model-agnostic defense that mitigates unknown backdoors by proactively injecting a defender-chosen backdoor: it trains on (x ⊕ ∆1 , h(y)) with a reversible mapping h and an auxiliary augmentation term (weight λ2 ), then stamps ∆1 and applies h−1 at inference. For TSF, we set h(y) = y + δ and h−1 (y) = y − δ on the target window, and use a fixed defensive trigger of value −1 (after normalization) over a specified span across all channels; we note this unrealistically assumes the defender knows the trigger length, otherwise performance degrades 25
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
substantially. We tune λ2 ∈ {0.0, 0.1, 1} and δ ∈ {0.001, 0.01, 0.1}. • ESTI (Yu et al., 2025). ESTI is a two-stage training-time defense that iteratively splits data into clean/poison pools using a KDE-based loss threshold (via benign vs. backdoor-sensitive training), and then isolates the suspected poison by training a trap model on a trap label. For TSF, we replace classification loss with per-window forecasting loss (SmoothL1) for KDE splitting, set the base learning rate to 10−4 , and keep the original relative scaling of stage-specific learning rates. Post-training-stage defenses. • Fine-tuning (Gu et al., 2019). Fine-tuning is a post-training repair baseline that continues training the (potentially backdoored) model on a small trusted clean subset, with the goal of reducing backdoor behavior while preserving clean performance. In TSF, we fine-tune on 5% clean training windows using the default forecasting loss and learning rate 10−4 . • Fine-pruning (Liu et al., 2018). Fine-pruning removes neurons that are rarely activated by clean inputs (ranked by average activation on a clean validation set) and then fine-tunes the pruned model to restore clean performance. For TSF, we prune units in ascending activation order on clean validation windows, iteratively removing a fraction n per round until the validation MAE increases by more than δ relative to the unpruned model, and then fine-tune with the same setting as above. We grid-search δ ∈ {0.01, 0.1, 0.2} and n ∈ {0.01, 0.05}. • NAD (Li et al., 2021b). NAD performs teacher–student fine-tuning: a teacher is first fine-tuned on a small trusted set, then the backdoored student is fine-tuned on the same set with an additional attention-distillation loss (weighted by β) that aligns intermediate attention maps. For TSF, we use the same 5% clean windows as the fine-tuning baseline for 50 epochs of each model, and tune NAD by scaling each default β in the released implementation by {0.1, 1, 100, 1000}. • IMS (Dunnett et al., 2025). IMS mitigates backdoors by learning an invertible pruning mask via bilevel optimization: an inner step generates bounded perturbations through the inverse mask, and an outer step updates the mask to reduce backdoor behavior while preserving clean accuracy. For TSF, we replace the classification agree/disagree terms with regression versions based on d = MSE(ŷ1 , ŷ2 ), i.e., pagree = exp(−αd), Lagree = − log(pagree + ϵ), and Ldis = − log(1 − pagree + ϵ), and tune the perturbation norm bound in {0.02, 0.2, 1.0}. Inference-time defenses. • STRIP (Gao et al., 2019). STRIP perturbs a test input by repeatedly superimposing it with randomly sampled clean windows and measures prediction randomness; triggered inputs tend to yield abnormally low randomness under such perturbations. For TSF, we replace class entropy with a forecast-dispersion score based on the normalized variance of predictions across perturbed copies, averaged over channels and horizon. We sample 100 clean windows per test input from a pool of 10,000 and tune the mixing strength α ∈ {0.1, 0.5, 1.0}. • TeCo (Liu et al., 2023a). TeCo applies multiple input corruptions with increasing severity and flags inputs whose robustness responses are inconsistent across corruption types. For TSF, we replace hard-label “prediction change” with a deviationbased transition score computed from relative prediction distances. We use four time-series corruptions: Gaussian noise, late cutout, local permutation, and moving-average smoothing, each with four severity levels (noise {0.1, 0.2, 0.3, 0.4}; cutout ratio {0.1, 0.2, 0.3, 0.4}; permutation length {T /6, T /4, T /3, T /2}; smoothing kernel {3, 5, 7, 9}). The TeCo score is the dispersion of normalized prediction deviations across corruption families. • IBD-PSC (Hou et al., 2024). IBD-PSC scales the affine parameters of late normalization layers by a factor ω and flags inputs whose predictions remain unusually consistent across scaled model variants. For TSF, we scale BN/LayerNorm affine parameters from the last layers backward and compute the score from prediction deviations. We select the scaling depth using relative clean-performance degradation and tune ω ∈ {1.25, 1.5, 1.75}.
G. Additional Experiment Results G.1. Full Defense Performance Results Complete results across datasets and attacks. Tables 10–17 report the full performance of all baselines and T IME G UARD under four representative TSF backdoor attacks (including Manhattan attack). Tables 10 and 11 summarize results over the three datasets , averaged across FEDformer (Zhou et al., 2022), SimpleTM (Chen et al., 2025a), and TimesNet (Wu et al., 2023), while Tables 12–17 provide per-architecture breakdowns. Overall, the appendix results are consistent with the findings and conclusions discussed in Sections 3 and 5.1.
26
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 10. Full main results of backdoor defenses against TSF backdoor attacks, averaged over FEDformer, SimpleTM, and TimesNet. Best results are in bold. Lower MAEC indicates better performance, while higher MAEP and FDER indicate better performance. Dataset
Attack → Defense ↓
Random Manhattan FreqBack-TSF BackTime MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense Spectral TED TED++ Fine-tuning Fine-pruning PEMS03 NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning Weather NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral
17.634 18.389 18.434 19.197 19.003 19.020 18.795 19.239 19.637 18.630 19.910 17.928 11.210 11.189 12.131 15.968 12.027 11.759 11.804 11.207 13.845 12.305 15.731 10.587 1.144 1.259
17.772 18.356 20.063 19.184 30.909 31.643 26.809 17.731 19.104 54.690 17.186 104.677 14.991 20.422 21.282 32.296 41.019 44.333 27.080 14.947 20.264 91.237 20.971 177.583 1.059 1.165
– 0.502 0.528 0.499 0.625 0.633 0.600 0.466 0.493 0.693 0.454 0.868 – 0.628 0.618 0.644 0.716 0.733 0.646 0.502 0.527 0.841 0.569 0.942 – 0.505
17.722 19.444 19.427 18.992 19.661 19.595 19.260 19.370 19.649 19.308 19.460 17.850 11.506 12.454 11.826 14.984 11.808 11.655 11.687 11.514 15.081 12.540 16.342 10.986 1.142 1.288
20.266 20.417 20.298 20.659 30.995 34.447 26.181 20.178 20.106 60.477 18.960 97.370 38.944 44.360 38.960 42.390 71.443 74.261 69.082 39.117 43.216 86.136 82.196 101.476 1.438 1.490
– 0.475 0.467 0.479 0.608 0.624 0.566 0.466 0.462 0.708 0.458 0.854 – 0.528 0.500 0.466 0.711 0.727 0.711 0.501 0.472 0.745 0.672 0.800 – 0.494
17.583 18.765 18.785 18.706 18.837 19.073 18.539 18.521 18.649 19.512 18.793 17.628 10.115 11.993 14.691 13.633 13.045 12.054 11.631 10.110 13.671 14.406 14.102 10.804 1.117 1.215
14.683 14.027 13.984 13.445 22.479 23.543 20.297 14.570 15.055 26.014 14.684 57.759 13.449 14.439 16.245 19.164 53.864 51.888 39.104 13.194 18.693 58.349 81.121 188.781 0.752 0.927
– 0.475 0.473 0.473 0.641 0.647 0.614 0.479 0.501 0.652 0.475 0.847 – 0.492 0.501 0.585 0.770 0.799 0.745 0.500 0.529 0.784 0.663 0.919 – 0.552
17.607 18.666 18.606 18.565 18.934 18.686 18.584 18.418 18.761 18.967 19.219 18.048 10.768 14.745 14.682 13.221 11.589 11.493 11.920 10.770 13.047 11.732 13.441 10.716 1.114 1.218
14.201 15.245 13.953 14.541 18.196 19.736 18.158 14.351 14.481 22.397 15.897 39.303 15.913 20.389 24.410 19.713 51.120 48.343 43.684 15.929 20.018 56.439 20.086 66.534 0.805 0.930
– 0.539 0.495 0.513 0.594 0.623 0.600 0.509 0.509 0.639 0.532 0.808 – 0.488 0.539 0.498 0.743 0.762 0.720 0.501 0.539 0.827 0.507 0.874 – 0.534
TED TED++ Fine-tuning Fine-pruning ETTm1 NAD IMS ABL PDB ESTI T IME G UARD
1.226 1.270 1.269 1.266 1.276 1.284 1.351 1.230 1.390 1.235
1.208 1.202 1.895 1.931 1.555 1.166 1.341 2.972 2.409 6.481
0.527 0.516 0.664 0.671 0.607 0.498 0.529 0.766 0.637 0.881
1.270 1.264 1.265 1.262 1.226 1.142 1.362 1.353 1.356 1.250
1.462 1.409 2.603 2.774 2.137 1.452 1.616 3.669 1.952 6.651
0.479 0.477 0.676 0.688 0.624 0.504 0.474 0.681 0.541 0.849
1.200 1.194 1.254 1.243 1.235 1.199 1.307 1.294 1.218 1.321
0.839 0.889 1.365 1.330 1.125 0.847 1.143 1.418 1.082 2.053
0.526 0.536 0.658 0.664 0.613 0.518 0.582 0.663 0.607 0.736
1.195 1.219 1.249 1.241 1.244 1.202 1.256 1.274 1.244 1.268
0.955 0.945 1.286 1.291 1.208 1.005 1.014 1.422 1.075 1.443
0.529 0.524 0.623 0.636 0.579 0.545 0.526 0.648 0.551 0.652
Table 11. Detection performance comparison of inference-time defenses on three datasets, averaged over FEDformer, SimpleTM, and TimesNet. Best results are in bold. Higher AUC and F1 indicates better detection performance. Dataset
Defense No Defense
PEMS03
Weather
ETTm1
Random
Manhattan
FreqBack-TSF
BackTime
AVERAGE
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.518
0.532
0.523
0.537
0.481
0.513
0.501
0.516
0.506
0.525
TeCo
0.563
0.564
0.563
0.563
0.431
0.506
0.478
0.512
0.509
0.536
IBD-PSC
0.364
0.514
0.402
0.522
0.416
0.519
0.486
0.535
0.417
0.523
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.300
0.510
0.461
0.518
0.589
0.591
0.497
0.531
0.462
0.538
TeCo
0.581
0.590
0.458
0.517
0.466
0.534
0.547
0.574
0.513
0.554
IBD-PSC
0.317
0.519
0.521
0.546
0.369
0.556
0.390
0.534
0.399
0.539
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.490
0.525
0.448
0.506
0.480
0.507
0.477
0.506
0.474
0.511
TeCo
0.614
0.591
0.519
0.544
0.640
0.612
0.524
0.521
0.574
0.567
IBD-PSC
0.378
0.513
0.464
0.523
0.497
0.532
0.486
0.518
0.456
0.522
27
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 12. Full main results of backdoor defenses against TSF backdoor attacks on FEDformer model. Best results are in bold. Lower MAEC indicates better performance, while higher MAEP and FDER indicate better performance. Attack → Defense ↓
Random Manhattan FreqBack-TSF BackTime MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense Spectral
16.286 16.930
14.959 15.658
– 0.503
16.411 16.567
17.984 18.960
– 0.521
16.179 16.232
9.436 9.627
– 0.508
16.093 16.484
10.760 11.221
– 0.509
TED TED++ Fine-tuning Fine-pruning PEMS03 NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning Weather NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral
16.607 18.093 16.758 16.836 16.599 16.286 17.591 16.774 18.896 16.607 9.282 9.286 9.161 9.412 9.174 9.155 9.111 9.282 10.044 9.890 9.076 9.162 1.121 1.134
15.402 19.247 48.550 49.054 39.003 14.953 18.677 25.809 15.727 100.436 13.400 18.636 19.594 45.224 77.684 86.216 44.531 13.020 11.555 41.380 23.477 102.996 1.218 1.306
0.505 0.561 0.832 0.831 0.799 0.500 0.562 0.696 0.455 0.916 – 0.640 0.658 0.845 0.914 0.922 0.850 0.500 0.462 0.807 0.715 0.935 – 0.528
16.667 17.542 16.887 16.951 16.616 16.411 17.141 17.254 18.102 16.578 8.781 9.495 9.271 10.853 9.252 9.127 9.032 8.785 9.633 9.619 8.569 9.584 1.109 1.142
17.639 18.627 41.641 51.561 32.060 17.982 17.898 37.089 17.401 94.212 22.145 22.391 19.516 21.064 71.884 72.853 67.813 22.210 22.443 54.644 102.159 96.013 1.662 1.826
0.492 0.485 0.770 0.810 0.713 0.500 0.479 0.733 0.453 0.900 – 0.468 0.474 0.405 0.820 0.829 0.823 0.501 0.462 0.754 0.892 0.843 – 0.531
16.378 16.103 16.835 16.871 16.558 16.179 16.990 16.914 16.432 16.496 9.434 10.107 9.670 9.506 9.785 9.802 9.801 9.430 9.823 9.609 8.440 9.536 1.111 1.138
9.496 9.257 18.616 20.123 15.765 9.430 10.627 17.076 9.199 38.147 9.423 7.347 6.263 19.342 85.835 70.408 60.086 8.868 7.480 30.494 5.191 76.651 0.671 0.794
0.497 0.500 0.727 0.745 0.689 0.500 0.532 0.702 0.492 0.867 – 0.467 0.488 0.753 0.927 0.914 0.903 0.500 0.480 0.836 0.500 0.933 – 0.565
16.284 16.332 16.414 16.408 16.377 16.684 16.803 17.040 16.284 16.840 9.609 9.460 9.775 9.517 9.517 9.600 9.584 9.610 11.159 10.254 8.882 10.089 1.085 1.160
10.828 10.882 17.767 21.445 17.941 13.569 11.183 14.511 11.212 41.232 8.020 8.280 10.295 8.135 69.535 58.004 55.976 8.029 12.711 35.951 4.855 43.244 0.911 0.775
0.497 0.498 0.687 0.740 0.691 0.586 0.498 0.601 0.514 0.847 – 0.516 0.602 0.507 0.942 0.931 0.928 0.501 0.615 0.857 0.500 0.883 – 0.468
TED TED++ Fine-tuning Fine-pruning ETTm1 NAD IMS ABL PDB ESTI T IME G UARD
1.096 1.130 1.180 1.181 1.155 1.121 1.275 1.142 1.301 1.220
1.201 1.258 2.273 2.229 1.994 1.229 1.630 3.479 1.464 6.664
0.500 0.512 0.707 0.701 0.680 0.504 0.566 0.816 0.514 0.868
1.128 1.145 1.173 1.161 1.148 1.109 1.345 1.343 1.398 1.213
1.695 1.498 2.534 2.612 2.403 1.665 2.052 2.681 1.764 7.138
0.502 0.484 0.645 0.660 0.637 0.501 0.507 0.603 0.426 0.841
1.100 1.088 1.217 1.176 1.163 1.110 1.327 1.220 1.193 1.298
0.566 0.708 1.759 1.541 1.310 0.670 1.492 1.078 0.888 1.912
0.500 0.526 0.766 0.754 0.721 0.500 0.693 0.644 0.587 0.752
1.125 1.106 1.191 1.177 1.161 1.080 1.296 1.261 1.261 1.256
0.997 0.851 1.698 1.659 1.667 1.103 1.152 1.715 1.406 1.304
0.525 0.490 0.687 0.686 0.694 0.587 0.523 0.664 0.606 0.582
Dataset
Table 13. Detection performance comparison of inference-time defenses on three datasets on FEDformer model. Best results are in bold. Higher AUC and F1 indicates better detection performance. Dataset
Defense No Defense
PEMS03
Weather
ETTm1
Random
Manhattan
FreqBack-TSF
BackTime
AVERAGE
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.502
0.522
0.523
0.532
0.500
0.520
0.504
0.517
0.507
0.523
TeCo
0.573
0.557
0.577
0.559
0.403
0.500
0.465
0.500
0.505
0.529
IBD-PSC
0.284
0.500
0.398
0.507
0.552
0.555
0.627
0.603
0.465
0.541
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.422
0.507
0.481
0.524
0.526
0.547
0.527
0.539
0.489
0.529
TeCo
0.599
0.587
0.554
0.541
0.587
0.571
0.442
0.521
0.546
0.555
IBD-PSC
0.331
0.501
0.505
0.520
0.455
0.567
0.362
0.502
0.413
0.523
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.406
0.501
0.401
0.501
0.496
0.513
0.466
0.507
0.442
0.506
TeCo
0.674
0.630
0.577
0.559
0.560
0.561
0.504
0.507
0.579
0.564
IBD-PSC
0.405
0.517
0.384
0.510
0.511
0.519
0.491
0.522
0.448
0.517
28
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 14. Full main results of backdoor defenses against TSF backdoor attacks on SimpleTM model. Best results are in bold. Lower MAEC indicates better performance, while higher MAEP and FDER indicate better performance. Dataset
Attack → Defense ↓
Random Manhattan FreqBack-TSF BackTime MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑
No Defense Spectral TED TED++ Fine-tuning
17.510 17.746 17.578 17.807 17.397
19.007 20.820 25.544 19.156 23.898
– 0.537 0.626 0.496 0.602
17.539 17.596 17.529 17.529 17.619
22.532 22.835 22.801 22.863 27.930
– 0.505 0.506 0.507 0.594
17.335 18.015 17.707 17.785 17.464
15.468 13.304 13.417 12.099 27.846
– 0.481 0.489 0.487 0.719
17.268 17.621 17.671 17.328 17.355
9.131 13.971 10.242 11.401 13.287
– 0.663 0.543 0.598 0.654
17.396 17.516 17.513 17.740 17.740 17.396 17.489 7.693 7.868 7.764 7.729 7.850 7.860 7.835 7.692 7.887 7.836 7.733 7.716 1.206 1.215 1.189 1.189 1.210 1.209 1.215 1.208 1.229 1.142 1.285 1.247
25.735 21.572 19.014 19.722 117.954 16.826 173.700 18.888 26.086 28.075 19.507 23.020 25.415 19.659 19.130 35.276 192.806 16.628 351.059 0.966 1.107 1.318 1.197 2.075 2.171 1.341 1.018 1.061 3.659 4.140 6.928
0.631 0.559 0.500 0.512 0.913 0.500 0.945 – 0.627 0.659 0.514 0.580 0.618 0.511 0.506 0.720 0.942 0.497 0.972 – 0.560 0.633 0.596 0.766 0.776 0.636 0.525 0.536 0.868 0.853 0.914
17.665 17.571 17.539 17.717 17.527 17.380 17.284 7.711 7.792 7.676 7.674 8.089 8.092 8.056 7.712 8.007 7.902 7.469 7.699 1.203 1.224 1.199 1.190 1.186 1.194 1.195 1.204 1.226 1.154 1.276 1.245
28.338 24.708 22.540 23.135 120.846 20.347 157.870 64.020 65.176 63.941 61.888 72.225 77.976 73.444 64.484 64.383 108.511 74.586 114.876 1.558 1.317 1.448 1.474 3.142 3.716 2.557 1.599 1.564 6.487 2.649 7.802
0.599 0.543 0.500 0.508 0.907 0.500 0.929 – 0.504 0.500 0.500 0.533 0.566 0.543 0.504 0.484 0.693 0.571 0.721 – 0.492 0.500 0.500 0.752 0.790 0.695 0.513 0.492 0.880 0.677 0.883
17.460 17.411 17.335 17.665 18.889 17.188 16.780 7.761 7.875 7.836 7.862 8.148 8.005 7.866 7.755 7.927 8.041 7.896 7.973 1.165 1.186 1.164 1.165 1.182 1.185 1.170 1.166 1.182 1.142 1.281 1.287
29.782 25.277 15.480 16.424 38.543 15.309 94.224 19.205 19.109 16.691 16.510 42.259 45.018 27.959 18.969 21.299 98.519 210.368 416.357 0.870 0.922 0.902 0.893 1.171 1.295 1.005 0.893 0.944 1.447 1.345 1.795
0.737 0.692 0.500 0.520 0.758 0.500 0.918 – 0.493 0.495 0.494 0.749 0.771 0.650 0.500 0.539 0.885 0.946 0.964 – 0.519 0.518 0.513 0.621 0.655 0.565 0.512 0.532 0.699 0.631 0.710
17.363 17.299 16.520 17.465 18.025 18.952 17.243 7.752 7.851 7.979 7.849 7.960 8.009 8.095 7.753 8.021 8.040 7.689 7.934 1.170 1.185 1.174 1.181 1.186 1.188 1.183 1.171 1.190 1.135 1.259 1.268
13.950 13.245 8.206 11.219 26.746 14.763 36.626 15.301 15.079 15.343 15.187 17.028 19.544 16.989 15.263 16.695 50.108 15.785 69.357 0.508 0.602 0.517 0.549 0.683 0.794 0.501 0.504 0.505 0.799 0.461 0.923
0.670 0.654 0.500 0.587 0.808 0.646 0.875 – 0.494 0.487 0.494 0.538 0.593 0.529 0.500 0.525 0.829 0.515 0.878 – 0.572 0.507 0.533 0.622 0.673 0.495 0.500 0.492 0.683 0.465 0.687
Fine-pruning NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning Weather NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning ETTm1 NAD IMS ABL PDB ESTI T IME G UARD
PEMS03
Table 15. Detection performance comparison of inference-time defenses on three datasets on SimpleTM model. Best results are in bold. Higher AUC and F1 indicates better detection performance. Dataset
Defense No Defense
PEMS03
Weather
ETTm1
Random
Manhattan
FreqBack-TSF
BackTime
AVERAGE
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.517
0.529
0.506
0.516
0.486
0.517
0.494
0.518
0.501
0.520
TeCo
0.680
0.628
0.670
0.627
0.510
0.517
0.541
0.535
0.600
0.577
IBD-PSC
0.436
0.525
0.434
0.548
0.263
0.500
0.364
0.500
0.374
0.518
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.308
0.521
0.395
0.515
0.737
0.701
0.420
0.515
0.465
0.563
TeCo
0.747
0.680
0.463
0.506
0.439
0.531
0.770
0.700
0.605
0.604
IBD-PSC
0.047
0.500
0.560
0.597
0.055
0.500
0.245
0.520
0.227
0.529
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.464
0.500
0.447
0.500
0.485
0.506
0.491
0.509
0.472
0.504
TeCo
0.533
0.539
0.594
0.572
0.597
0.575
0.541
0.533
0.566
0.555
IBD-PSC
0.421
0.523
0.507
0.544
0.526
0.575
0.482
0.532
0.484
0.544
29
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 16. Full main results of backdoor defenses against TSF backdoor attacks on TimesNet model. Best results are in bold. Lower MAEC indicates better performance, while higher MAEP and FDER indicate better performance. Dataset
Attack → Defense ↓
No Defense Spectral TED TED++ Fine-tuning Fine-pruning PEMS03 NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning Weather NAD IMS ABL PDB ESTI T IME G UARD No Defense Spectral TED TED++ Fine-tuning Fine-pruning ETTm1 NAD IMS ABL PDB ESTI T IME G UARD
Random Manhattan FreqBack-TSF BackTime MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ 19.104 20.492 21.116 21.692 22.852 22.828 22.270 23.919 23.579 21.375 23.440 19.687 16.653 16.412 19.469 30.764 19.056 18.261 18.466 16.648 23.605 19.188 30.383 14.883 1.106 1.427 1.394 1.491 1.417 1.407 1.459 1.523 1.548 1.407 1.583 1.239
19.351 18.591 19.244 19.150 20.279 20.139 19.851 19.225 18.912 20.306 19.006 39.894 12.684 16.542 16.176 32.157 22.354 21.368 17.050 12.691 13.962 39.525 22.809 78.694 0.992 1.080 1.106 1.152 1.338 1.392 1.330 1.250 1.331 1.779 1.624 5.852
– 0.466 0.452 0.440 0.441 0.438 0.442 0.399 0.405 0.470 0.408 0.743 – 0.617 0.536 0.573 0.653 0.659 0.579 0.500 0.399 0.773 0.496 0.919 – 0.428 0.448 0.440 0.520 0.536 0.506 0.466 0.485 0.614 0.544 0.862
19.216 24.168 24.086 21.906 24.476 24.168 23.592 24.160 24.091 23.142 22.899 19.689 18.026 20.076 18.531 26.426 18.082 17.745 17.971 18.044 27.601 20.099 32.988 15.675 1.113 1.497 1.484 1.458 1.434 1.430 1.335 1.114 1.515 1.561 1.395 1.291
20.283 19.455 20.453 20.487 23.412 23.441 21.775 20.013 19.283 23.497 19.134 40.029 30.666 45.515 33.423 44.219 70.219 71.955 65.990 30.657 42.822 95.252 69.844 93.538 1.094 1.327 1.243 1.253 2.133 1.994 1.450 1.093 1.232 1.838 1.443 5.013
– 0.398 0.403 0.444 0.459 0.465 0.442 0.398 0.399 0.484 0.420 0.735 – 0.612 0.528 0.494 0.780 0.787 0.768 0.499 0.468 0.787 0.554 0.836 – 0.460 0.435 0.446 0.632 0.615 0.540 0.500 0.424 0.559 0.520 0.822
19.234 22.047 22.270 22.228 22.211 22.887 21.647 22.048 21.293 22.733 22.760 19.609 13.148 17.997 26.568 23.532 21.202 18.355 17.227 13.144 23.263 25.566 25.970 14.902 1.074 1.320 1.337 1.329 1.363 1.368 1.372 1.320 1.412 1.519 1.180 1.378
19.146 19.149 19.040 18.979 20.975 20.725 19.849 18.800 18.113 22.423 19.543 40.905 11.719 16.863 25.782 21.640 33.497 40.239 29.268 11.745 27.300 46.034 27.804 73.334 0.714 1.067 1.049 1.065 1.165 1.153 1.059 0.980 0.992 1.728 1.014 2.453
– 0.436 0.432 0.433 0.477 0.458 0.462 0.436 0.452 0.496 0.433 0.756 – 0.518 0.520 0.509 0.635 0.713 0.681 0.501 0.568 0.630 0.542 0.861 – 0.572 0.561 0.569 0.587 0.583 0.554 0.542 0.520 0.647 0.603 0.744
19.459 21.891 21.862 22.033 23.032 22.286 22.076 22.049 22.014 21.836 22.420 20.061 14.943 26.925 26.293 22.297 17.291 16.871 18.082 14.948 19.962 16.903 23.750 14.125 1.086 1.308 1.287 1.369 1.371 1.359 1.387 1.355 1.281 1.426 1.213 1.279
22.713 20.544 20.789 21.340 23.534 23.813 23.288 21.278 21.043 25.933 21.717 40.052 24.417 37.809 47.592 35.818 66.797 67.479 58.089 24.494 30.649 83.259 39.619 87.000 0.996 1.412 1.352 1.434 1.477 1.421 1.457 1.409 1.386 1.752 1.359 2.103
– 0.444 0.445 0.442 0.440 0.460 0.453 0.441 0.442 0.508 0.434 0.701 – 0.455 0.528 0.494 0.749 0.762 0.703 0.501 0.476 0.795 0.506 0.860 – 0.563 0.554 0.550 0.559 0.549 0.550 0.548 0.565 0.597 0.581 0.688
Table 17. Detection performance comparison of inference-time defenses on three datasets on TimesNet model. Best results are in bold. Higher AUC and F1 indicates better detection performance. Dataset
Defense No Defense
PEMS03
Weather
ETTm1
Random
Manhattan
FreqBack-TSF
BackTime
AVERAGE
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
AUC ↑
F1 ↑
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.536
0.545
0.539
0.563
0.457
0.502
0.507
0.513
0.510
0.531
TeCo
0.437
0.506
0.442
0.503
0.379
0.501
0.428
0.500
0.422
0.503
IBD-PSC
0.372
0.516
0.375
0.511
0.434
0.502
0.468
0.500
0.412
0.507
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.171
0.503
0.507
0.514
0.505
0.525
0.545
0.537
0.432
0.520
TeCo
0.398
0.503
0.357
0.504
0.372
0.500
0.431
0.500
0.390
0.502
IBD-PSC
0.573
0.555
0.497
0.521
0.596
0.599
0.563
0.580
0.557
0.564
No Defense
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
0.500
STRIP
0.601
0.573
0.497
0.518
0.458
0.502
0.475
0.503
0.508
0.524
TeCo
0.633
0.604
0.386
0.500
0.763
0.700
0.527
0.523
0.577
0.582
IBD-PSC
0.307
0.500
0.501
0.513
0.455
0.501
0.484
0.501
0.437
0.504
30
x
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Robustness against BadTime attack. Beyond evaluating defenses against three SOTA attacks, we also evaluate T IME G UARD against the recent TSF backdoor attack BadTime (Xiang et al., 2025). BadTime leverages inter-variable correlations, temporal lags, and data-driven initialization to construct distributed, lag-aware triggers for effective and stealthy attacks. For our BadTime implementation, we attempt to replicate the method using its default hyperparameters. For defense evaluation, after obtaining the fixed BadTime trigger, we poison the datasets and then apply the PDB and T IME G UARD training pipelines. Table 18 shows that T IME G UARD remains effective under this recent attack setting and achieves the best overall trade-off, attaining the highest FDER of 0.847 while maintaining competitive clean forecasting performance, even outperforming vanilla training in terms of clean MAEC . Table 18. Defense performance of PDB (Wei et al., 2024) and T IME G UARD under BadTime (Xiang et al., 2025) a on PEMS03 dataset, where FEDFormer, SimpleTM, and TimesNet are the victim models. Best results are in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 20.399 17.797 – 20.940 18.640 – 23.755 26.316 – 21.698 20.918 – PDB (Wei et al., 2024) 19.372 36.976 0.759 21.455 38.732 0.747 24.390 37.878 0.640 21.739 37.862 0.715 T IME G UARD 17.287 37.524 0.867 19.109 37.165 0.918 21.600 39.563 0.756 19.332 38.084 0.847
Generalization to additional architectures. Beyond the three backbone forecasters used in our main experiments, two Transformer-based models (FEDformer (Zhou et al., 2022) and SimpleTM (Chen et al., 2025a)) and one CNN-based model (TimesNet (Wu et al., 2023)), we further evaluate T IME G UARD on a broader set of TSF architectures under the Random and BackTime attacks on PEMS03 dataset. Concretely, we include SegRNN (Lin et al., 2023) (RNN-based), SOFTS (Han et al., 2024) and TimeMixer (Wang et al., 2024) (MLP-based), and AutoTimes (Liu et al., 2024c) as an emerging LLM-based forecaster with two large LLM variants (GPT2 (Radford et al., 2019) and OPT-1.3B (Zhang et al., 2022)). As shown in Table 19, T IME G UARD consistently attains MAEP above 32 and FDER above 0.68, while incurring at most a 10% relative increase in MAEC across two attacks. Specifically, on the LLM-based method (AutoTimes), T IME G UARD yielding at least a 5.14× MAEP gain with only a 3.8% change in clean MAEC . Overall, these results support that T IME G UARD is architecture-agnostic and remains effective across diverse forecasting architectures. Table 19. Defense performance across 8 models with different architectures under Random and BackTime attacks on PEMS03 dataset. Attack → Defense →
Random No Defense
BackTime
T IME G UARD
No Defense
T IME G UARD
Model ↓
MAEC ↓
MAEP ↑
MAEC ↓
MAEP ↑
FDER ↑
MAEC ↓ MAEP ↑
MAEC ↓
MAEP ↑
FDER ↑
FEDformer (Zhou et al., 2022) SimpleTM (Chen et al., 2025a) TimesNet (Wu et al., 2023) SegRNN (Lin et al., 2023) SOFTS (Han et al., 2024) TimeMixer (Wang et al., 2024) AutoTimesGPT2 (Liu et al., 2024c) AutoTimesOPT1B (Liu et al., 2024c)
16.286 17.510 19.104 19.889 16.263 21.540 20.984 20.911
14.959 19.007 19.351 8.953 2.930 19.917 19.346 22.946
16.607 17.489 19.687 20.469 16.871 21.351 21.292 21.054
100.436 173.700 39.894 205.044 170.169 220.274 215.993 221.067
0.916 0.945 0.743 0.964 0.973 0.955 0.948 0.945
16.093 17.268 19.459 19.980 16.227 21.484 21.006 20.921
16.840 17.243 20.061 20.718 17.451 21.440 21.805 21.196
41.232 36.626 40.052 33.941 33.340 33.662 32.046 33.931
0.847 0.875 0.701 0.880 0.917 0.687 0.884 0.903
10.760 9.131 22.713 6.927 3.185 21.053 6.239 6.162
Defense performance under large-scale TSF foundation models. Beyond AutoTimesGPT2 and AutoTimesOPT1B (Liu et al., 2024c),we further evaluate AutoTimesLLaMA7B , an AutoTimes variant built on the large-scale LLaMA-7B foundation model (Touvron et al., 2023). Table 20 shows that T IME G UARD still outperforms PDB while keeping the total training time to 1.431× that of undefended training and comparable to PDB, i.e., approximately 70,000 seconds. These results suggest that T IME G UARD transfers beyond standard TSF backbones and remains effective for large-scale TSF foundation models. Table 20. Defense performance and training time (in seconds) of PDB (Wei et al., 2024) and T IME G UARD under BackTime on the PEMS03 dataset, using AutoTimesLLaMA7B (Liu et al., 2024c) as the victim model. Best results are shown in bold. Defense No Defense PDB (Wei et al., 2024) T IME G UARD
Training time (s) ↓
MAEC ↓
MAEP ↑
FDER ↑
49027.6 69997.6 70162.8
20.977 22.657 21.385
6.004 25.798 32.792
– 0.847 0.899
31
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Generalization to different poisoning rates. We evaluate the robustness of T IME G UARD under varying attack budgets by adjusting the temporal poisoning rate ηT and spatial poisoning rate ηS using the BackTime attack on the PEMS03 dataset. As shown in Figures 8–10, T IME G UARD consistently maintains strong defense effectiveness across all poisoning rates, with MAEP remaining above 35 for all three models. Additionally, clean performance stays within 5% even at high poisoning rates (ηT = 0.04, ηS = 0.4). These results demonstrate that T IME G UARD is robust to varying poisoning rates while maintaining reasonable clean performance.
TimeGuard Undefended
30 20 10
1
2
3
40 20 10
4
TimeGuard Undefended
30
Temporal poisoning rate T (%)
10
20
30
40
Spatial poisoning rate S (%)
17.50 17.25 17.00 16.75 16.50 16.25 16.00 15.75
TimeGuard Undefended
1
2
3
MAEC ( )
MAEP ( )
MAEP ( )
40
MAEC ( )
50
50
4
16.8 16.6 16.4 16.2 16.0 15.8
Temporal poisoning rate T (%)
TimeGuard Undefended
10
20
30
40
Spatial poisoning rate S (%)
1
2
3
4
Temporal poisoning rate T (%)
TimeGuard Undefended
10
20
30
40
18.2 18.0 17.8 17.6 17.4 17.2 17.0 16.8
TimeGuard Undefended
1
Spatial poisoning rate S (%)
2
3
17.3
MAEC ( )
TimeGuard Undefended
40 35 30 25 20 15 10
MAEC ( )
40 35 30 25 20 15 10
MAEP ( )
MAEP ( )
Figure 8. Defense performance of T IME G UARD (MAEP and MAEC ) under varying temporal and spatial poisoning rates of the BackTime attack on the PEMS03 dataset with the FEDformer model.
17.2 17.1 16.9
4
TimeGuard Undefended
17.0
Temporal poisoning rate T (%)
10
20
30
40
Spatial poisoning rate S (%)
1
2
3
4
Temporal poisoning rate T (%)
TimeGuard Undefended
21.0
TimeGuard Undefended
20.5
MAEC ( )
TimeGuard Undefended
40.0 37.5 35.0 32.5 30.0 27.5 25.0 22.5 20.0
MAEC ( )
40.0 37.5 35.0 32.5 30.0 27.5 25.0 22.5
MAEP ( )
MAEP ( )
Figure 9. Defense performance of T IME G UARD (MAEP and MAEC ) under varying temporal and spatial poisoning rates of the BackTime attack on the PEMS03 dataset with the SimpleTM model.
20.0 19.5 19.0
10
20
30
40
Spatial poisoning rate S (%)
1
2
3
4
Temporal poisoning rate T (%)
22.0 21.5 21.0 20.5 20.0 19.5
TimeGuard Undefended
10
20
30
40
Spatial poisoning rate S (%)
Figure 10. Defense performance of T IME G UARD (MAEP and MAEC ) under varying temporal and spatial poisoning rates of the BackTime attack on the PEMS03 dataset with the TimesNet model.
Generalization to the extreme case of full-channel poisoning. Our motivation is strongest under partial-channel poisoning, which is the common setting in existing multivariate TSF backdoor attacks; as the channel poisoning ratio increases, attacks generally become less stealthy and easier to detect. Nevertheless, T IME G UARD does not require poisoning to affect only a strict subset of channels: its channel-wise formulation remains applicable even when poisoning is dense across channels. To directly test the all-channel case, we evaluate T IME G UARD on PEMS03 under BackTime with spatial poisoning ratio ηS = 1.0, meaning that all channels are poisoned. As shown in Table 21, T IME G UARD remains effective in this setting and achieves the highest FDER of 0.748. Table 21. Defense performance of PDB and T IME G UARD under BackTime attack on the PEMS03 dataset with full-channel poisoning, i.e., ηS = 1.0, where FEDformer, SimpleTM, and TimesNet are used as victim models. Best results are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 18.025 11.586 – 18.567 5.817 – 27.473 21.503 – 21.355 12.969 – PDB (Wei et al., 2024) 18.308 16.074 0.632 19.114 13.355 0.768 23.731 32.485 0.669 20.384 20.638 0.690 T IME G UARD 18.176 26.268 0.775 19.464 13.938 0.768 21.974 35.797 0.700 19.871 25.335 0.748
32
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Generalization to different attack patterns. We further evaluate the robustness of T IME G UARD under three attack patterns from the original BackTime work (Lin et al., 2024) (described in Appendix F.5) on the PEMS03 dataset. As shown in Table 22, T IME G UARD consistently demonstrates strong robustness across all attack patterns, including Random, Manhattan, and BackTime attacks, averaged over the three models. Compared to the state-of-the-art defense PDB, T IME G UARD significantly improves both MAEP and FDER, while maintaining clean performance with minimal degradation. The results for the up-and-down and up-trend attack patterns, broken down by model, are provided in Tables 23 and 24, respectively. Table 22. Defense performance of T IME G UARD across three different attack patterns under Random, Manhattan, and BackTime attacks on PEMS03, average over FEDFormer, SimpleTM, and TimesNet models. Best results are in bold. Attack Pattern
Cone
Up & Down
Up Trend
Attack → Defense ↓ No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD
MAEC ↓ 17.634 19.003 19.020 18.630 17.928 17.628 19.161 19.078 19.150 18.055 17.721 19.223 19.211 19.227 18.022
Random MAEP ↑ 17.772 30.909 31.643 54.690 104.677 17.903 26.878 29.024 45.243 80.871 18.472 32.865 33.532 58.857 111.006
FDER ↑ – 0.625 0.633 0.693 0.868 – 0.609 0.629 0.669 0.835 – 0.636 0.640 0.683 0.872
MAEC ↓ 17.722 19.661 19.595 19.308 17.850 17.679 19.196 19.193 19.146 17.985 17.733 19.540 19.620 19.201 17.985
Manhattan MAEP ↑ 20.266 30.995 34.447 60.477 97.370 20.213 28.158 30.267 42.813 75.454 21.010 33.298 34.720 70.032 101.135
FDER ↑ – 0.608 0.624 0.708 0.854 – 0.588 0.606 0.649 0.810 – 0.624 0.622 0.687 0.856
MAEC ↓ 17.607 18.934 18.686 18.967 18.048 17.389 18.772 18.743 20.028 18.158 17.615 18.935 19.028 19.783 18.273
BackTime MAEP ↑ 14.201 18.196 19.736 22.397 39.303 16.853 19.479 20.980 21.720 30.165 13.674 19.706 21.771 22.195 46.106
FDER ↑ – 0.594 0.623 0.639 0.808 – 0.576 0.593 0.567 0.709 – 0.629 0.648 0.645 0.834
Generalization to different forecasting horizons. Beyond the default forecasting horizon used in BackTime (Lin et al., 2024) (Lout =12), we further evaluate T IME G UARD under longer horizons with Lout ∈ {24, 36, 48}. Following BackTime’s protocol, we assume the attacker knows the forecasting horizon used by the victim model. As shown in Figures 11–13, T IME G UARD maintains competitive clean performance (MAEC ) across all horizons, and even outperforms undefended training on TimesNet in some cases. As Lout increases, BackTime itself becomes less effective (e.g., poisoned MAEP exceeds 30 across models when Lout =48), which correspondingly lowers FDER; nevertheless, T IME G UARD remains robust, with defended MAEP staying above 28.4 in all settings. We observe that, except for TimesNet, the defense effectiveness of T IME G UARD lightly decreases for FEDformer and SimpleTM at longer horizons (Lout ∈ 36, 48). A plausible explanation is that losses over longer target windows become more diluted across distant time steps, reducing the discriminability used by DRLS (Eq. 10). A potential remedy is to adopt a weighted loss that prioritizes nearer horizons, which we leave for future work. Overall, these results indicate that T IME G UARD remains effective against TSF backdoor attacks under different forecasting horizons. Table 23. Defense performance of T IME G UARD under Random, Manhattan, and BackTime attacks with a up-and-down attack pattern on the PEMS03 dataset, where FEDFormer, SimpleTM, and TimesNet are the victim models. Best results are in bold. Model
FEDformer
SimpleTM
TimesNet
Attack → Defense ↓ No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD
MAEC ↓ 16.370 16.802 16.772 16.898 16.551 17.428 17.534 17.468 17.555 17.335 19.087 23.149 22.994 22.996 20.278
Random MAEP ↑ 15.193 35.086 38.811 21.148 67.162 19.133 24.886 27.910 91.863 140.540 19.383 20.661 20.352 22.720 34.911
FDER ↑ – 0.771 0.792 0.625 0.881 – 0.613 0.656 0.892 0.932 – 0.443 0.439 0.488 0.693
MAEC ↓ 16.413 16.998 16.882 17.259 16.564 17.461 17.515 17.568 17.610 17.024 19.161 23.073 23.131 22.569 20.368
33
Manhattan MAEP ↑ 18.700 35.427 39.564 24.828 65.542 20.735 27.539 29.781 79.668 126.706 21.202 21.508 21.456 23.943 34.114
FDER ↑ – 0.719 0.750 0.599 0.853 – 0.622 0.649 0.866 0.918 – 0.422 0.420 0.482 0.660
MAEC ↓ 15.943 16.559 16.650 17.273 16.776 17.209 17.247 17.264 18.996 17.188 19.016 22.508 22.315 23.816 20.508
BackTime MAEP ↑ 10.461 18.153 23.142 16.246 27.529 12.936 16.747 16.289 22.338 28.395 27.161 23.535 23.509 26.576 34.571
FDER ↑ – 0.693 0.753 0.640 0.785 – 0.613 0.601 0.663 0.772 – 0.422 0.426 0.399 0.571
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 24. Defense performance of T IME G UARD under Random, Manhattan, and BackTime attacks with up-trend attack pattern on PEMS03 dataset, where FEDFormer, SimpleTM, and TimesNet are the victim models. Best results are in bold.
SimpleTM
MAEP ( )
TimesNet
50 45 40 35 30 25 20 15 10
MAEC ↓ 16.420 16.863 16.792 16.875 16.610 17.613 17.683 17.661 17.866 17.066 19.129 23.121 23.179 22.939 20.389
TimeGuard Undefended
12
24
Random MAEP ↑ 15.652 50.608 51.944 23.665 102.645 20.562 26.638 27.625 130.997 185.689 19.203 21.347 21.028 21.908 44.684
36
48
26 24 22 20 18 16
Forecasting Window Length (Lout)
FDER ↑ – 0.832 0.838 0.656 0.918 – 0.612 0.626 0.914 0.945 – 0.464 0.456 0.479 0.754
MAEC ↓ 16.434 16.864 16.811 17.156 16.598 17.441 17.659 17.717 17.667 16.951 19.325 24.097 24.332 22.780 20.404
Manhattan MAEP ↑ 18.461 42.857 49.437 29.193 98.314 24.170 33.546 31.995 157.867 160.888 20.399 23.492 22.729 23.035 44.203
TimeGuard Undefended
12
24
FDER ↑ – 0.772 0.802 0.663 0.901 – 0.634 0.615 0.917 0.925 – 0.467 0.448 0.481 0.743
FDER ( )
FEDformer
Attack → Defense ↓ No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD No Defense Fine-tuning Fine-pruning PDB T IME G UARD
MAEC ( )
Model
36
MAEC ↓ 16.105 16.594 16.661 17.347 16.855 17.302 17.350 17.483 18.218 17.263 19.439 22.862 22.940 23.785 20.703
0.85 0.80 0.75 0.70 0.65 0.60 0.55 0.50
48
FDER ↑ – 0.748 0.792 0.647 0.872 – 0.681 0.707 0.803 0.904 – 0.459 0.446 0.486 0.726
TimeGuard 12
Forecasting Window Length (Lout)
BackTime MAEP ↑ 10.772 22.653 28.115 16.996 50.734 7.999 12.608 13.888 23.245 41.806 22.250 23.857 23.310 26.345 45.776
24
36
48
Forecasting Window Length (Lout)
TimeGuard Undefended 12
24
36
48
32.5 30.0 27.5 25.0 22.5 20.0 17.5
Forecasting Window Length (Lout)
TimeGuard Undefended
12
24
FDER ( )
35 30 25 20 15 10
MAEC ( )
MAEP ( )
Figure 11. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) under different forecasting window length Lout of the BackTime attack on the PEMS03 dataset with the FEDformer model.
36
0.85 0.80 0.75 0.70 0.65 0.60 0.55 0.50
48
TimeGuard
12
Forecasting Window Length (Lout)
24
36
48
Forecasting Window Length (Lout)
TimeGuard Undefended 12
24
36
48
Forecasting Window Length (Lout)
TimeGuard Undefended
25 24 23 22 21 20 12
24
FDER ( )
40.0 37.5 35.0 32.5 30.0 27.5 25.0 22.5
MAEC ( )
MAEP ( )
Figure 12. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) under different forecasting window length Lout of the BackTime attack on the PEMS03 dataset with the SimpleTM model.
36
48
Forecasting Window Length (Lout)
0.70 0.68 0.66 0.64 0.62 0.60 0.58
TimeGuard
12
24
36
48
Forecasting Window Length (Lout)
Figure 13. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) under different forecasting window length Lout of the BackTime attack on the PEMS03 dataset with the TimesNet model.
34
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
Generalization to large-scale datasets. To evaluate the scalability of T IME G UARD, we further do experiments on GBA (Liu et al., 2023b), using its 2019 subset, which is a much larger traffic forecasting benchmark (35040 × 2352) than the datasets used in our main experiments. Even at this scale, T IME G UARD achieves the best overall defense performance, with an average FDER of 0.698. We also explicitly report the increased training cost, showing that T IME G UARD remains effective on substantially larger datasets, albeit with higher training overhead. This training time is notably higher than that on our previous largest benchmark, PEMS03, i.e., 3372s as reported in Table 6. The overhead corresponds to ≈ 3.53× the cost of undefended training, indicating that T IME G UARD remains scalable in practice but incurs nontrivial additional cost. Table 25. Defense performance and training time (in seconds) of PDB and T IME G UARD under BackTime attack on the GBA dataset (Liu et al., 2023b), where FEDformer, SimpleTM, and TimesNet are used as victim models. Best results are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ Training Time ↓ MAEC ↓ MAEP ↑ FDER ↑ Training Time ↓ MAEC ↓ MAEP ↑ FDER ↑ Training Time ↓ MAEC ↓ MAEP ↑ FDER ↑ Training Time ↓ No Defense 27.259 26.234 – 5625.6 32.814 37.735 – 6169.1 31.846 41.139 – 7134.3 30.640 35.036 – 6309.7 PDB (Wei et al., 2024) 26.705 39.016 0.664 5625.3 32.406 48.588 0.612 6419.8 32.326 51.237 0.591 8541.8 30.479 46.280 0.622 6862.3 T IME G UARD 28.463 69.200 0.789 23390.1 39.874 54.641 0.566 22641.2 31.647 79.109 0.740 20745.8 33.328 67.650 0.698 22259.0
Generalization to discrete, count-valued datasets. While our main evaluation focuses on continuous-valued datasets, we further assess T IME G UARD on a discrete, count-valued dataset. Specifically, we use the hourly subset of Bike Sharing (Fanaee-T, 2013), which records hourly bike rental counts from 2011 to 2012 in the Capital Bikeshare system, and evaluate under the Random attack. For preprocessing, we retain “temp”, “atemp”, “hum”, “windspeed”, and “cnt”, and use “cnt”, a discrete variable representing the number of rental bikes, as the target variable, resulting in 17,379 time stamps. As shown in Table 26, T IME G UARD still achieves the best defense performance, with an average FDER of 0.831. This suggests preliminary transfer beyond continuous-valued TSF, while broader adaptation to discrete and count-valued forecasting remains future work. Table 26. Defense performance of PDB and T IME G UARD under Random attack on the Bike Sharing dataset (Fanaee-T, 2013), where FEDformer, SimpleTM, and TimesNet are used as victim models. Best results are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 23.921 66.894 – 24.143 66.465 – 20.377 47.904 – 22.814 60.421 – PDB (Wei et al., 2024) 22.368 120.193 0.722 24.472 124.615 0.727 19.131 103.550 0.769 21.990 116.119 0.739 T IME G UARD 28.355 249.084 0.788 20.699 243.449 0.863 22.751 227.498 0.843 23.935 240.010 0.831
Robustness on distribution-shifted and nonstationary datasets. Since T IME G UARD relies on a hand-designed neighborhood metric, its estimates may degrade under strong distribution shift and nonstationarity. To evaluate this scenario, we test T IME G UARD on Exchange, a financial forecasting benchmark with evolving dynamics that contains daily exchange rates from 8 countries between 1990 and 2016 (Lai et al., 2018), totaling 7,588 time steps, under the BackTime attack. The results in Table 27 show that, despite these challenging evolving dynamics, T IME G UARD remains effective and outperforms PDB. This suggests that T IME G UARD remains practically effective even under stronger distribution shift and nonstationarity. Table 27. Defense performance of PDB and T IME G UARD under BackTime attack on the Exchange dataset (Lai et al., 2018), where FEDformer, SimpleTM, and TimesNet are used as victim models. Best results are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 0.00967 0.02143 – 0.00699 0.01927 – 0.03089 0.10875 – 0.01585 0.04982 – PDB (Wei et al., 2024) 0.01654 0.08107 0.66040 0.00737 0.10169 0.87944 0.05331 0.16554 0.46127 0.02574 0.11610 0.66704 T IME G UARD 0.00803 0.11179 0.90417 0.00673 0.10451 0.90782 0.03829 0.14101 0.51782 0.01768 0.11911 0.77660
Robustness under nonstationary settings and concept drift. To further examine robustness under mild distribution change and concept drift, we conduct an additional experiment on PEMS03 under the BackTime attack by introducing synthetic distribution shifts at test time. Specifically, let xt,c denote the value at time step t and channel c, and let σc denote the standard deviation of channel c computed from the training dataset. We consider three perturbations: • Scale shift: x′t,c = (1 + α)xt,c • Mean shift: x′t,c = xt,c + ασc • Linear trend: x′t,c = xt,c + ασc Tt , where T is the length of test split. We test two shift strengths, α ∈ {0.1, 0.2}. As shown in Table 28, the performance of all methods declines slightly under synthetic distribution shift. However, T IME G UARD consistently achieves the best defense performance across all six shifted 35
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
settings. This suggests that although non-stationarity affects performance, its negative impact is moderate rather than catastrophic, and T IME G UARD remains stable in practice under mild distribution shifts. Under strongly non-stationary or concept-drift scenarios, any training-phase defense is likely to face challenges, and T IME G UARD is no exception, as also reflected by the degraded performance of both undefended training and PDB. Table 28. Defense performance of T IME G UARD and PDB under BackTime attack on PEMS03 dataset under mild distribution shift, where FEDFormer, SimpleTM, and TimesNet are the victim models. Best results in each scenario are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 16.688 13.577 – 16.519 8.218 – 22.041 21.293 – 18.416 14.363 – No shift PDB (Wei et al., 2024) 17.420 16.038 0.556 18.283 25.700 0.792 23.586 26.898 0.571 19.763 22.879 0.640 T IME G UARD 16.850 42.101 0.834 17.688 36.386 0.854 20.562 40.005 0.734 18.367 39.497 0.807 No Defense 18.323 14.860 – 18.171 8.696 – 25.510 24.590 – 20.668 16.049 – Scale shift PDB (Wei et al., 2024) 19.039 17.560 0.558 20.229 26.254 0.784 27.108 30.703 0.570 22.125 24.839 0.637 (α = 0.1) T IME G UARD 18.508 42.423 0.820 19.457 36.707 0.849 23.672 40.808 0.699 20.546 39.979 0.789 No Defense 19.977 16.170 – 19.823 9.241 – 30.968 29.982 – 23.590 19.682 – Scale shift PDB (Wei et al., 2024) 20.734 19.108 0.482 22.384 27.480 0.775 32.602 36.076 0.559 25.240 27.555 0.605 (α = 0.2) T IME G UARD 20.225 42.811 0.762 21.226 37.050 0.842 28.465 42.762 0.649 23.305 40.874 0.751 No Defense 16.689 14.860 – 16.519 8.696 – 21.761 24.590 – 18.323 16.049 – Linear trend PDB (Wei et al., 2024) 17.446 16.029 0.515 18.409 25.862 0.781 23.117 28.007 0.532 19.657 23.300 0.609 (α = 0.1) T IME G UARD 16.841 42.123 0.819 17.688 36.386 0.847 20.523 41.380 0.703 18.351 39.963 0.790 No Defense 16.690 13.515 – 16.518 8.218 – 22.140 29.982 – 18.450 17.239 – Linear trend PDB (Wei et al., 2024) 17.482 16.028 0.556 18.641 26.046 0.785 23.364 29.682 0.474 19.829 23.919 0.605 (α = 0.2) T IME G UARD 16.836 42.139 0.835 17.688 36.401 0.854 20.990 42.854 0.650 18.505 40.465 0.780 No Defense 16.688 13.515 – 16.519 8.217 – 22.051 23.388 – 18.419 15.040 – Mean shift PDB (Wei et al., 2024) 17.474 16.016 0.556 18.607 26.066 0.786 23.242 29.628 0.580 19.774 23.903 0.641 (α = 0.1) T IME G UARD 16.838 42.166 0.835 17.688 36.422 0.854 20.901 42.946 0.728 18.476 40.512 0.806 No Defense 16.693 13.462 – 16.519 8.217 – 23.937 26.798 – 19.050 16.159 – Mean shift PDB (Wei et al., 2024) 17.559 16.028 0.555 19.207 26.066 0.772 24.941 33.902 0.585 20.569 25.332 0.637 (α = 0.2) T IME G UARD 16.836 42.227 0.836 17.688 36.422 0.854 22.566 46.094 0.709 19.030 41.581 0.800 Shift / Strength
G.2. Ablation Study Full Results We provide per-model ablation results on the PEMS03 dataset under the Random, Manhattan, and BackTime attacks in Table 29 with FEDformer, SimpleTM, and TimesNet. Overall, these results are consistent with the model-averaged trends reported in Section 5.2. G.3. Hyperparameter Sensitivity Full Results Influence of α and β. Figures 14–16 report the T IME G UARD defense performance with FEDformer, SimpleTM, and TimesNet on PEMS03 under the BackTime attack while varying α ∈ {0.10, 0.15, 0.20, 0.25, 0.30} and β ∈ {0.40, 0.50, 0.60, 0.70, 0.80} combination. Consistent with the model-averaged trends in Section 5.2, it recommends choosing α ∈ [0.15, 0.25] and β ∈ [0.5, 0.7] to balance clean performance and robustness.
MAEP ( )
MAEC ( ) 0.10 17.10 16.93 16.73 16.65 16.52
0.10 41.32 39.79 40.85 38.89 20.39 17.0
0.15 40.78 41.18 40.32 39.16 36.44
0.20 17.04 16.84 16.75 16.56 16.45
16.8
0.20 40.48 41.23 39.31 41.51 28.10
0.25 17.07 16.82 16.71 16.55 16.43
16.6
0.25 39.73 40.22 40.82 38.12 25.87
0.15 17.03 16.87 16.69 16.48 16.49
0.30 17.03 16.81 16.58 16.55 16.43 0.40 0.50 0.60 0.70 0.80
16.4
0.30 41.41 41.53 40.87 37.95 24.47 0.40 0.50 0.60 0.70 0.80
FDER ( ) 40
0.10 0.840 0.840 0.849 0.845 0.723
0.85
0.15 0.841 0.846 0.849 0.851 0.840
30
0.20 0.839 0.847 0.844 0.856 0.798 0.25 0.836 0.845 0.850 0.845 0.782
20
0.80 0.75
0.30 0.843 0.849 0.854 0.844 0.770 0.40 0.50 0.60 0.70 0.80
Figure 14. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) with different initial reliable-pool ratio α and final ratio β under BackTime attack on the PEMS03 dataset with the FEDformer model.
36
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 29. Per-model ablation results of T IME G UARD on PEMS03 under the Random, Manhattan, and BackTime attacks, with FEDformer, SimpleTM, and TimesNet as victim models. The AVERAGE row reports the mean across the three models, matching Table 5. Model
FEDformer
SimpleTM
TimesNet
AVERAGE
Attack → Defense ↓ No Defense T IME G UARD w/o Channel-wise w/o NDF w/o RCF w/o NDF+RCF w/o DRLS No Defense T IME G UARD w/o Channel-wise w/o NDF w/o RCF w/o NDF+RCF w/o DRLS No Defense T IME G UARD w/o Channel-wise w/o NDF w/o RCF w/o NDF+RCF w/o DRLS No Defense T IME G UARD w/o Channel-wise w/o NDF w/o RCF w/o NDF+RCF w/o DRLS
MAEC ( )
MAEC ↓ 16.286 16.607 16.558 16.717 16.622 16.549 17.727 17.510 17.489 16.826 18.740 17.311 17.577 19.970 19.104 19.687 21.577 20.286 20.255 20.880 21.545 17.634 17.928 18.320 18.581 18.063 18.336 19.748
Random MAEP ↑ 14.959 100.436 14.915 91.682 99.747 83.125 15.775 19.007 173.700 14.307 180.126 172.719 151.760 194.031 19.351 39.894 19.212 41.563 40.748 40.456 19.520 17.772 104.677 16.145 104.457 104.405 91.780 76.442
FDER ↑ – 0.916 0.492 0.906 0.915 0.902 0.485 – 0.945 0.500 0.914 0.945 0.935 0.889 – 0.743 0.443 0.738 0.734 0.718 0.448 – 0.868 0.478 0.853 0.865 0.852 0.607
MAEC ↓ 16.411 16.578 16.660 16.695 16.639 16.549 17.618 17.539 17.284 16.660 16.695 16.639 17.793 19.945 19.216 19.689 21.389 20.370 20.043 20.366 21.723 17.722 17.850 18.236 17.920 17.774 18.236 19.762
MAEP ( )
Manhattan MAEP ↑ 17.984 94.212 18.462 87.981 89.769 82.560 16.000 22.532 157.870 18.462 87.981 89.769 139.796 173.531 20.283 40.029 20.662 39.967 39.957 39.382 21.164 20.266 97.370 19.195 71.976 73.165 87.246 70.232
0.10 17.57 17.41 17.33 17.09 17.15
17.6
0.10 35.56 35.04 35.77 34.92 36.37
0.15 17.49 17.20 16.89 17.04 17.03
17.4
0.15 36.83 37.33 37.17 36.70 31.28
0.20 17.55 17.28 17.07 16.94 16.98 0.25 17.42 17.22 17.12 17.07 17.08 0.30 17.53 17.31 17.11 17.08 17.06
17.2 17.0
0.20 35.93 36.56 37.07 35.25 35.49 0.25 35.60 35.97 36.35 36.23 34.52 0.30 35.86 34.69 37.06 36.00 34.28
MAEC ↓ 16.093 16.840 17.959 16.947 16.962 16.740 17.711 17.268 17.243 17.666 17.400 17.703 17.094 20.628 19.459 20.061 21.580 20.908 21.158 20.985 21.905 17.607 18.048 19.068 18.418 18.608 18.273 20.081
BackTime MAEP ↑ 10.760 41.232 12.832 39.474 40.913 40.111 9.509 9.131 36.626 6.615 36.145 37.717 35.681 31.919 22.713 40.052 25.328 39.428 40.207 39.889 27.327 14.201 39.303 14.925 38.349 39.612 38.560 22.918
FDER ↑ – 0.847 0.529 0.839 0.843 0.847 0.454 – 0.875 0.489 0.870 0.867 0.872 0.776 – 0.701 0.502 0.677 0.677 0.679 0.529 – 0.808 0.507 0.795 0.796 0.799 0.586
FDER ( ) 36 34 32
0.40 0.50 0.60 0.70 0.80
0.40 0.50 0.60 0.70 0.80
FDER ↑ – 0.900 0.505 0.889 0.893 0.887 0.466 – 0.929 0.500 0.872 0.874 0.912 0.875 – 0.735 0.458 0.718 0.726 0.714 0.463 – 0.854 0.488 0.826 0.831 0.838 0.601
0.10 0.863 0.866 0.871 0.869 0.874 0.15 0.870 0.878 0.877 0.876 0.854
0.88 0.87
0.20 0.865 0.875 0.877 0.870 0.871 0.25 0.867 0.873 0.874 0.874 0.868
0.86
0.30 0.865 0.867 0.877 0.873 0.867 0.40 0.50 0.60 0.70 0.80
Figure 15. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) with different initial reliable-pool ratio α and final ratio β under BackTime attack on the PEMS03 dataset with the SimpleTM model.
MAEP ( )
MAEC ( ) 0.10 20.26 20.17 20.13 20.14 20.02 0.15 20.04 20.04 20.10 20.06 20.02
20.2
0.20 20.10 20.06 20.08 20.05 19.99
20.1
0.25 20.26 20.25 20.22 20.21 20.17 0.30 20.01 20.02 19.97 19.96 19.99 0.40 0.50 0.60 0.70 0.80
FDER ( )
0.10 39.39 39.61 40.00 40.13 40.55 0.15 39.15 39.61 40.02 40.41 40.76
41
0.20 40.13 40.05 40.90 40.80 41.71 0.25 40.11 39.99 39.77 40.17 40.38
20.0
0.10 0.692 0.696 0.699 0.700 0.706
0.30 40.33 40.36 40.58 41.10 40.95 0.40 0.50 0.60 0.70 0.80
40 39
0.15 0.695 0.699 0.700 0.704 0.707
0.71
0.20 0.701 0.701 0.707 0.707 0.715 0.25 0.697 0.696 0.696 0.699 0.701 0.30 0.705 0.704 0.707 0.711 0.709 0.40 0.50 0.60 0.70 0.80
0.70 0.69
Figure 16. Defense performance of T IME G UARD (MAEP , MAEC , and FDER) with different initial reliable-pool ratio α and final ratio β under BackTime attack on the PEMS03 dataset with the TimesNet model.
37
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
0.10 0.15 0.20 0.25 0.30
0.86 0.84 0.82 0.80 0.78
0.10 0.15 0.20 0.25 0.30
FDER ( )
0.88 0.86 0.84 0.82 0.80 0.78 0.76
FDER ( )
0.885 0.880 0.875 0.870 0.865 0.860
FDER ( )
FDER ( )
We further evaluate the effects of pool sizes α and β on the Weather dataset under the BackTime attack, as shown in Figure 17 and Figure 18. Specifically, we vary α ∈ {0.10, 0.15, 0.20, 0.25, 0.30} with β fixed at 0.50, and vary β ∈ {0.40, 0.50, 0.60, 0.70, 0.80} with α fixed at 0.20. Overall, T IME G UARD remains effective across all settings, achieving FDER above 0.75 in every case. These results lead to the same conclusion as in Section 5.1 on PEMS03 dataset: α ∈ [0.15, 0.25] and β ∈ [0.5, 0.7] provide the best trade-off, as reflected by FDER.
0.10 0.15 0.20 0.25 0.30
0.88 0.87 0.86 0.85 0.84 0.83 0.82 0.81
0.10 0.15 0.20 0.25 0.30
0.879
0.4
0.5
0.6
0.7
0.8
FDER ( )
0.878 0.877 0.876 0.875
0.4
0.5
0.6
0.7
0.86 0.85 0.84 0.83 0.82 0.81 0.80 0.79
FDER ( )
0.95 0.90 0.85 0.80 0.75 0.70 0.65
FDER ( )
FDER ( )
Figure 17. Defense performance of T IME G UARD in terms of FDER with different initialization ratios α under the BackTime attack on the Weather dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
0.4
0.8
0.5
0.6
0.7
0.8
0.88 0.86 0.84 0.82 0.80 0.78 0.76
0.4
0.5
0.6
0.7
0.8
Figure 18. Defense performance of T IME G UARD in terms of FDER with different maximum pool ratios β under the BackTime attack on the Weather dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
10
20
32
K
48
64
0.875 0.874 0.873 0.872 0.871 0.870 0.869 0.868 0.867
0.746
FDER ( )
0.849 0.848 0.847 0.846 0.845 0.844 0.843
FDER ( )
FDER ( )
Influence of K and π. Figures 19 and 20 report the T IME G UARD defense performance with FEDformer, SimpleTM, and TimesNet on PEMS03 under the BackTime attack while varying the neighborhood size K ∈ {10, 20, 32, 48, 64} and the scaling factor π ∈ {1.05, 1.15, 1.25, 1.35, 1.50, 1.65}, respectively. Consistent with the model-averaged trends in Section 5.2, T IME G UARD is relatively insensitive to the choice of K, while we recommend selecting π ≤ 1.5.
10
20
32
K
48
0.745 0.744 0.743
64
10
20
32
K
48
64
0.710
0.875
1.05 1.15 1.25 1.35
1.50
1.65
0.870
FDER ( )
0.847 0.846 0.845 0.844 0.843 0.842 0.841
FDER ( )
FDER ( )
Figure 19. Defense performance of T IME G UARD (FDER) with different neighborhood size K under BackTime attack on the PEMS03 dataset with the FEDformer, SimpleTM, and TimesNet, respectively.
0.865 0.860 0.855
0.705 0.700 0.695 0.690
1.05 1.15 1.25 1.35
1.50
1.65
1.05 1.15 1.25 1.35
1.50
1.65
Figure 20. Defense performance of T IME G UARD (FDER) with different scaling factor π under BackTime attack on the PEMS03 dataset with the FEDformer, SimpleTM, and TimesNet, respectively.
38
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
10 20
32
K
48
64
10 20
32
K
48
64
0.855 0.850 0.845 0.840 0.835 0.830 0.825 0.820
FDER ( )
0.882 0.881 0.880 0.879 0.878 0.877 0.876 0.875 0.874
FDER ( )
0.89 0.88 0.87 0.86 0.85 0.84 0.83
FDER ( )
FDER ( )
We also vary K and π under the BackTime attack on the Weather dataset, as shown in Figure 21–22, and under the Random attack on the PEMS03 dataset, as shown in Figure 23–24. Consistent with the results on PEMS03 under BackTime in Section 5.1, T IME G UARD is relatively insensitive to the choice of K, and we recommend selecting π ≤ 1.5. These results also suggest that the effects of K and π in T IME G UARD are consistent across different datasets and attack scenarios.
10 20
32
K
48
0.868 0.866 0.864 0.862 0.860 0.858 0.856 0.854
64
10 20
32
K
48
64
0.885
FDER ( )
0.880 0.875 0.870 0.865
1.05 1.15 1.25 1.35 1.50 1.65
0.85 0.84 0.83 0.82 0.81
1.05 1.15 1.25 1.35 1.50 1.65
FDER ( )
0.89 0.88 0.87 0.86 0.85 0.84 0.83
FDER ( )
FDER ( )
Figure 21. Defense performance of T IME G UARD in terms of FDER with different neighborhood sizes K under the BackTime attack on the Weather dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
1.05 1.15 1.25 1.35 1.50 1.65
0.875 0.870 0.865 0.860 0.855 0.850
1.05 1.15 1.25 1.35 1.50 1.65
Figure 22. Defense performance of T IME G UARD in terms of FDER with different scaling factors π under the BackTime attack on the Weather dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
0.916 0.915 0.914
10 20
32
K
48
64
0.746
10 20
32
K
48
0.745 0.744 0.743
64
0.869
FDER ( )
0.917
0.945 0.944 0.943 0.942 0.941 0.940 0.939 0.938
FDER ( )
0.918
FDER ( )
FDER ( )
0.919
10 20
32
K
48
0.868 0.867 0.866 0.865
64
10 20
32
K
48
64
1.05 1.15 1.25 1.35 1.50 1.65
0.750
0.870
0.745
0.865
0.740 0.735 0.730 0.725
1.05 1.15 1.25 1.35 1.50 1.65
FDER ( )
0.946 0.944 0.942 0.940 0.938 0.936 0.934 0.932 0.930
FDER ( )
0.920 0.915 0.910 0.905 0.900 0.895
FDER ( )
FDER ( )
Figure 23. Defense performance of T IME G UARD in terms of FDER with different neighborhood sizes K under the Random attack on the PEMS03 dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
1.05 1.15 1.25 1.35 1.50 1.65
0.860 0.855 0.850
1.05 1.15 1.25 1.35 1.50 1.65
Figure 24. Defense performance of T IME G UARD in terms of FDER with different scaling factors π under the Random attack on the PEMS03 dataset, reported for FEDformer, SimpleTM, TimesNet, and their average.
Influence of Tb . We further study the sensitivity to the number of backcaster training epochs Tb used in the BLS module. Figure 25 reports the defense performance of T IME G UARD on PEMS03 under the BackTime attack for all three victim models while Tb ∈ {0, 5, 10, 20, 40, 60}. When Tb < 10, the backcaster is likely under-trained, making its loss signal less reliable for separating clean and poisoned samples, which results in suboptimal defense performance. To balance robustness and training cost, we set Tb =10 by default, which adds only roughly 10% overhead to the training pipeline while reducing the risk of overfitting, where the backcaster may start fitting poisoned hard samples. 39
0.876
0.700
0.874
FDER ( )
0.848 0.847 0.846 0.845 0.844 0.843 0.842
FDER ( )
FDER ( )
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
0.872 0.870
20
Tb
40
0 5 10
60
0.690 0.685 0.680
0.868 0 5 10
0.695
20
Tb
40
0 5 10
60
20
Tb
40
60
Figure 25. Defense performance of T IME G UARD (FDER) with varying backcaster bϕ training epoch Tb under BackTime attack on the PEMS03 dataset with the FEDformer, SimpleTM, and TimesNet, respectively.
Influence of T1 and T2 . We study the sensitivity to the stage-wise training budgets T1 (Stage I) and T2 (Stage II) of T IME G UARD, while fixing the total budget to T1 + T2 = 100. Figure 26 reports the defense performance on PEMS03 under the BackTime attack for all three victim models, varying T1 ∈ {0, 5, 10, 20, 30, 40} with the corresponding T2 ∈ {100, 95, 90, 80, 70, 60}. Overall, performance tends to degrade as T1 increases, suggesting that overly long Stage I training may overfit the initial reliable pool and leave insufficient budget for incorporating newly admitted reliable samples in Stage II. Notably, for SimpleTM and TimesNet, a short Stage I training (T1 ≤ 10) improves subsequent progressive training, since Stage II relies on the current model’s loss signal for selecting reliable samples. We set T1 =10 and T2 =90 by default, which is also consistent with common two-stage training schedules used in backdoor defenses (Li et al., 2021a; Gao et al., 2023a).
0.844 0.842 0.840 0
5 10
20
T1
30
40
0.875 0.870 0.865 0.860 0.855 0.850 0.845
FDER ( )
0.846
FDER ( )
FDER ( )
0.848
0
5 10
20
T1
30
40
0.703 0.702 0.701 0.700 0.699 0.698 0.697
0
5 10
20
T1
30
40
Figure 26. Defense performance of T IME G UARD (FDER) with varying training epoch T1 under BackTime attack on the PEMS03 dataset with the FEDformer, SimpleTM, and TimesNet, respectively.
G.4. Detailed Efficiency Analysis As shown in Table 6, T IME G UARD introduces additional training-time overhead, mainly from Stage I backcaster training and neighborhood-based filtering. However, this cost is limited and temporary: Stage I runs for only Tb epochs, which we set to approximately 10% of the total training budget by default. After Stage I, the backcaster is discarded, so its additional memory overhead does not persist into the main training stage. Importantly, this differs from the repeated inference-time overhead discussed in Table 2, since T IME G UARD introduces no additional latency during deployment. To reduce this cost, we implement neighborhood search in a precompute-and-reuse manner instead of recomputing all distances repeatedly. Specifically, we compute the channel-wise neighbor graph only once before the main Stage II training, cache the top-Kmax neighbors for each sample, and reuse these cached neighborhoods throughout filtering and selection rather than recomputing kNN every epoch. By default, we set Kmax = 2K; our preliminary experiments show that T IME G UARD is insensitive to the choice of Kmax . This keeps the defense model-agnostic while avoiding repeated full-distance searches during training. As shown in Table 20, T IME G UARD incurs training time comparable to PDB, the leading baseline, while achieving better defense performance on large-scale time-series foundation models based on LLaMA-7B (Touvron et al., 2023). Similar scalability trends are also observed on large-scale datasets, as shown in Table 25. G.5. Potential Adaptive Attacks We consider a worst-case scenario in which the attacker deliberately adapts the attack strategy to circumvent our defense. Design. We construct an adaptive variant of BackTime (Lin et al., 2024) by augmenting the trigger-generator training objective. To challenge our unidirectional trigger-to-target assumption, we assume the attacker has access to a pre-trained backcaster bϕ trained on the clean dataset. The attacker then adds a reverse-consistency regularizer Luni that encourages 40
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting Table 30. Defense performance of T IME G UARD under BackTime and adaptive attacks on PEMS03 dataset, where FEDFormer, SimpleTM, and TimesNet are the victim models. Best results under adaptive attack are in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 16.093 10.760 – 17.268 9.131 – 19.459 22.713 – 17.607 14.201 – BackTime T IME G UARD 16.840 41.232 0.847 17.243 36.626 0.875 20.061 40.052 0.701 18.048 39.303 0.808 No Defense 16.383 13.779 – 17.491 10.744 – 22.498 21.507 – 18.791 15.343 – T IME G UARD 17.066 30.035 0.751 17.707 22.393 0.754 20.540 39.298 0.726 18.438 30.575 0.744 Adaptive T IME G UARD w/o NDF 17.012 29.622 0.749 17.287 22.053 0.756 21.392 37.411 0.713 18.564 29.695 0.739 T IME G UARD w/o DRLS 19.035 14.558 0.457 21.093 15.808 0.575 22.460 26.712 0.597 20.863 19.026 0.543 Attack
the induced target pattern (specified by the attack target P) to reconstruct the generated trigger G, making the trigger and target more mutually predictive. In addition, to weaken our neighborhood similarity signal based on weighted Pearson correlation, the attacker introduces a similarity regularizer Lsim that maintains a buffer of previously generated poisoned samples and penalizes the distance between the current poisoned sample and the buffer, thereby encouraging diversification. The resulting adaptive objective is: Ladap = Lbd + λ1 Luni + λ2 Lsim , where Lbd is the original BackTime backdoor objective and λ1 , λ2 are attacker-controlled hyperparameters. In our implementation, we grid-search λ1 ∈ {0.1, 0.5, 1} and λ2 ∈ {10, 100, 1000}. Results. Table 30 shows that, on PEMS03, this adaptive attack attains an average MAEC of 18.791 and an average MAEP of 15.343, which is slightly worse than the original BackTime attack (17.607 MAEC and 14.201 MAEP , averaged over models). This suggests that enforcing additional constraints, namely reverse consistency and similarity regularization, can hinder the attacker. This observation aligns with our analysis that effective TSF backdoors rely on generating highly similar trigger-induced patterns, as discussed in Theorem 4.1. Meanwhile, T IME G UARD remains effective under this adaptive threat, achieving 18.438 MAEC , 30.575 MAEP , and 0.744 FDER, which remains within a strong defense-performance range. This trend is consistent across all forecasting models. We attribute this robustness primarily to the distance-aware criteria, which exploit the attacker’s structural need to produce highly correlated poisoned samples for successful backdoor activation. G.6. Neighborhood Distance Analysis As T IME G UARD relies on a hand-designed neighborhood metric, e.g., correlation-/distance-based kNN on normalized windows, input-space distances may degrade under strong distribution shifts or nonstationarity. To examine whether learned representations can provide a more robust neighborhood signal, we replace our Gaussian-weighted input-space distance with a TS2Vec embedding distance (Yue et al., 2022) on the Weather dataset under the BackTime attack. For implementation, we train TS2Vec on the full training set with hidden dimension 64, output dimension 128, and depth 6, and then use the resulting sample embeddings to compute neighborhood distances. Since this representation-learning step is computationally expensive, taking approximately 80,000 seconds, we evaluate this variant only on the moderate-scale Weather dataset. Table 31. Defense performance of PDB, T IME G UARD, and T IME G UARDemb , a variant of T IME G UARD that uses TS2Vec embeddings (Yue et al., 2022) as sample representations for neighborhood-distance computation, under the BackTime attack on the Weather dataset. FEDformer, SimpleTM, and TimesNet are used as victim models. Best results are shown in bold. Model → FEDformer SimpleTM TimesNet AVERAGE Defense ↓ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ MAEC ↓ MAEP ↑ FDER ↑ No Defense 9.609 8.020 – 7.752 15.301 – 14.943 24.417 – 10.768 15.913 – PDB (Wei et al., 2024) 10.254 35.951 0.857 8.040 50.108 0.829 16.903 83.259 0.795 11.732 56.439 0.827 T IME G UARD 10.089 43.244 0.883 7.934 69.357 0.878 14.125 87.000 0.860 10.716 66.534 0.874 T IME G UARDemb 10.142 34.681 0.858 8.256 64.011 0.850 17.289 85.908 0.790 11.896 61.534 0.833
Results. As shown in Table 31, the embedding-based variant of T IME G UARD still outperforms PDB across all models. However, it does not improve over the original input-space version. This suggests that generic learned embeddings such as TS2Vec do not automatically provide a stronger signal for TSF backdoor defense in our setting, consistent with previous observations on the limited effectiveness of generic data embeddings for time series forecasting (Nematirad et al., 2025). We leave the design of more dedicated embeddings for TSF backdoor defense to future work. 41
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
G.7. Clean Performance under No Attack Table 32. Clean performance (MAEC ↓) of in-training backdoor defenses under no attack scenario on PEMS03. Best results are in bold.
Model →
SimpleTM FEDformer TimesNet AVERAGE
Defense ↓ Vanilla Training
16.794
15.680
20.257
17.577
ABL
17.129
16.928
21.011
18.356
PDB
17.828
16.843
22.308
18.993
ESTI
17.396
15.915
20.119
17.810
T IME G UARD
17.197
16.695
19.804
17.899
In realistic scenarios, the defender may not know whether the training set has been poisoned. We therefore evaluate an extreme setting where no poisoning is present (No Attack). Table 32 reports the clean forecasting performance of four in-training defenses on the PEMS03 dataset under this setting. Overall, ESTI and T IME G UARD preserve clean accuracy well, with at most a 3.5% degradation across three models compared to vanilla training, and they even improve performance for TimesNet in some cases; both outperform ABL and PDB in this no-attack regime. However, ESTI incurs substantially higher training cost and is more prone to failing under attacks in our TSF setting (Appendix G.4 and Section 5.1). Taken together, these results suggest that T IME G UARD offers a more practical trade-off when the poisoning status of the training data is unknown. G.8. Reliable Pool Dynamics Illustration
140
TimeGuard (w/o NDF+DRLS) TimeGuard
300
MAEP (↑) (w/o NDF+DRLS)
120
MAEC (↓) (w/o NDF+DRLS) MAEP (↑) MAEC (↓)
100
200
MAE
Poison Sample Count
To illustrate how T IME G UARD maintains a reliable pool during training, we plot (i) the number of poisoned samples admitted into the reliable pool at each epoch, together with the corresponding (ii) clean performance (MAEC ) and poisoned performance (MAEP ) of FEDformer. We compare T IME G UARD against its loss-only variant (w/o NDF+DRLS) under the Random attack on three datasets, as shown in Figures 27–29 for PEMS03, Weather, and ETTm1, respectively. Overall, T IME G UARD consistently admits fewer poisoned samples into the reliable pool than the loss-only variant, helping explain its strong robustness and competitive clean performance. These dynamics also highlight the importance of incorporating neighborhood-distance cues beyond loss-only criteria.
100
80 60 40 20
0 1
20
40
Epoch
60
80
100
(a) Number of poisoned samples in the reliable pool.
1
20
40
Epoch
60
80
100
(b) Clean and defense performance (MAEC and MAEP ).
Figure 27. Dynamic illustration of T IME G UARD at each training epoch under Random attack on PEMS03 dataset of FEDformer model.
H. Showcases To better visualize the effectiveness of T IME G UARD, we provide an inference-time prediction example for the FEDformer model under the BackTime attack on PEMS03 in Figure 27, where the showcased triggers are sampled from different channels and different test samples. Overall, T IME G UARD preserves accurate forecasts on clean channels while substantially mitigating trigger-induced manipulation on poisoned channels. Moreover, even when the input window is perturbed by the trigger, T IME G UARD can partially recover the underlying future trend. We also observe that the generated triggers exhibit similar shapes despite BackTime using sample-dependent triggers, which further supports our analysis in Theorem 4.1. 42
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
200
TimeGuard (w/o NDF+DRLS) TimeGuard
500
MAEP (↑) (w/o NDF+DRLS) MAEC (↓) (w/o NDF+DRLS) MAEP (↑) MAEC (↓)
150
400
MAE
Poison Sample Count
600
300
100
200 50
100 0 1
20
40
Epoch
60
80
0
100
(a) Number of poisoned samples in the reliable pool.
1
20
40
Epoch
60
80
100
(b) Clean and defense performance (MAEC and MAEP ).
Figure 28. Dynamic illustration of T IME G UARD at each training epoch under Random attack on Weather dataset of FEDformer model.
8
TimeGuard (w/o NDF+DRLS) TimeGuard
800
MAEP (↑) (w/o NDF+DRLS) MAEC (↓) (w/o NDF+DRLS) MAEP (↑) MAEC (↓)
6
600
MAE
Poison Sample Count
1000
400 200
4
2
0 1
20
40
Epoch
60
80
100
1
(a) Number of poisoned samples in the reliable pool.
20
40
Epoch
60
80
100
(b) Clean and defense performance (MAEC and MAEP ).
Figure 29. Dynamic illustration of T IME G UARD at each training epoch under Random attack on ETTm1 dataset of FEDformer model.
100
220
80
200
60
180
120 100 80 60
160
40
Clean Channel
40
15 14 13 12 11 10 9 8
Poison Channel
100 80
Original Data Undefended Prediction TimeGuard Prediction
Clean Channel
60 50 40
160
200
150
180
130 120
Original Data Trigger Pattern Target Pattern Undefended Prediction TimeGuard Prediction
140
60 40 20 360 340 320 300 280 260
40 90
120
100
100
90
80
80
60
70
40
60
100
60
Original Data Undefended Prediction TimeGuard Prediction
160
80
450 425 400 375 350 325 300 275 250
120
80
40
70
220
140
60
80
170
100
80 70 60 50 40 30
160 140 120 100 80
20
Figure 30. Inference-time prediction showcases of T IME G UARD under the BackTime attack on PEMS03 of FEDformer model, visualized on alternating poisoned and clean channels. We display a randomly selected test sample with a randomly selected channel.
43
T IME G UARD: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting
I. Limitations and Future Work Limitations. First, T IME G UARD relies on a hand-designed neighborhood metric, e.g., correlation-/distance-based kNN on normalized windows, to construct and refine the reliable pool. Such input-space distances may degrade under strong distribution shifts or nonstationarity. Our preliminary experiments suggest that this degradation is moderate rather than catastrophic; however, T IME G UARD is not immune to this issue, and existing training-phase defenses also suffer under these challenging settings, as discussed in Appendix G.1. Second, TSF backdoor defenses in general face an inherent precision–recall trade-off when the trigger and induced target are not “out-of-distribution” relative to clean dynamics. If the trigger and target mimic prevalent motifs (e.g., a near-linear upward trend), poisoned and clean windows can be ambiguous in both learning-based and neighborhood structure: filtering/detecting may remove frequent clean patterns, while retaining them may preserve backdoor influence. Future work. A natural direction is to augment our input-space kNN with TSF-specific embedding spaces where neighborhoods better reflect forecasting semantics, e.g., via self-supervised or contrastive representations (Zhang et al., 2024a; Zheng et al., 2025). Although we conduct preliminary experiments using TS2Vec embeddings (Yue et al., 2022), as discussed in Appendix G.6, the results remain unsatisfactory and do not outperform our original input-space implementation. Future work could explore representations specifically tailored to TSF backdoor defense. Another direction is to utilize (rather than discard) the unreliable pool with semi-supervised learning (Cho & Lee, 2025); however, current TSF semisupervised methods are often architecture-dependent, motivating deeper study of architecture-agnostic formulations under backdoor settings. Finally, multivariate TSF offers opportunities to leverage cross-channel structure (e.g., dependency graphs or causal signals (Qiu et al., 2025; Han et al., 2025)) to localize corrupted channels while improving clean and recovery forecasting performance. More broadly, we hope this work encourage TSF-specific backdoor defense research and time series security in general, including standardized benchmarks, stronger adaptive attacks/defenses, and principled evaluation protocols.
44