Adversarial robustness of deep state space models for time series forecasting

The paper studies, from a cybernetics perspective, the robustness of deep state space models (SSMs) for time series forecasting under adversarial perturbations, focusing on the Spacetime SSM predictor. The authors prove that the decoder-only Spacetime architecture can represent the optimal Kalman predictor when the data-generating process is autoregressive, and state that other SSMs do not possess this property. The paper formalizes robust predictor design as a Stackelberg game against a worst-case stealthy adversary constrained by a detection budget, solves it via adversarial training, and derives a closed-form bound on adversarial forecasting error, revealing that open-loop instability, closed-loop instability, and decoder state dimension all amplify vulnerability. The research also shows that an adversary without access to the predictor can exploit the model's locally linear input-output behavior to bypass gradient computation and construct effective attacks; experiments on the Monash benchmark datasets show that such attacks without gradient computation cause at least 33% more error than small-step projected gradient descent (PGD).