When Temporal Perturbations Act Like Sensor Biases: Label-Free Auditing of Wearable Activity Recognizers
Qingyu Wu, Yuan Wei, Renju Liu, Hua Cheng
cs.LG · cs.AI · cs.CR
Quick verdict
Label-sealed select-then-project audit shows HAR perturbation failures mostly DC-carried; rigorous and honest, though DC-retained search risks circularity.
Summary
The paper introduces SpectrumAudit, a two-stage, label-free auditing protocol for wearable human-activity recognition (HAR) classifiers that asks whether an adversarially selected smooth perturbation derives its damage from a persistent offset (DC) or from time-varying content (AC). In stage one, a phase-randomized full-window waveform is fitted on unlabeled calibration windows from subjects held out of training and testing, using an objective combining pseudo-label cross-entropy, feature-cosine, JS-divergence, and total-variation terms under an L-infinity budget of 0.30 standard deviations. In stage two, the locked waveform is replayed without refitting as its exact per-channel mean (DC) and a budget-constrained zero-mean residual (AC). Across 27 victims (PAMAP2, WISDM, USC-HAD x FCN, ResNet, Transformer x three seeds), full drops span 2.87-40.83 pp; DC exceeds AC on 24/27 victims and recovers at least 90% of the drop on 22/27, with all five failures on WISDM. Matched controls show the proposed objective offers no strength advantage over pseudo-label CE (+0.07 pp, CI [-0.69, 0.72]) - the contribution is diagnosis, not attack strength. A held-out UTD-MHAD check yields a 13.49 pp drop versus -0.66 pp for matched random waveforms. Limitations: the search retains DC (no symmetric zero-mean-constrained selection), some victims are weak (USC-HAD around 47-49% clean accuracy), code is promised only upon acceptance, and DC is measured in standardized units, not validated as a physical sensor bias.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A label-sealed, subject-disjoint select-then-project audit can attribute a selected perturbation's damage to a persistent DC offset versus zero-mean AC content on a frozen victim.
- Across 27 victims, DC replay exceeds AC replay on 24/27 and recovers at least 90% of the full drop on 22/27, with all five exceptions on WISDM.
- The audit's objective provides no attack-strength advantage over pseudo-label UAP-CE (paired difference +0.07 pp, CI [-0.69, 0.72]); its value is diagnostic, not offensive.
- The DC-AC robust-drop gap across nine cell means is 16.95 pp (bootstrap CI [10.86, 22.06], cluster sign-flip p=0.0078).
- Findings generalize to a held-out UTD-MHAD victim (13.49 pp drop vs -0.66 pp for matched random waveforms).
Strengths
Well-posed mechanism decomposition
The select-then-project design (Sec. 3, Fig. 2) locks the waveform after selection and then replays its exact DC projection and budget-constrained AC residual without refitting, cleanly separating component attribution from attack strength - a question prior smooth-perturbation work (refs 8-12) does not answer.
Unusual claim discipline
Table 1 and the 27-victim replication show the proposed objective is statistically indistinguishable from pseudo-label UAP-CE (+0.07 pp, 95% CI [-0.69, 0.72], p=0.938), and the authors explicitly disclaim any attack-strength advantage and label all victim diagnostics exploratory and non-causal (Sec. 4.2).
Strong protocol hygiene
Cluster-aware uncertainty for the headline gap
External and robustness checks
Weaknesses
Selection-attribution circularity is not fully excluded
Unexplained failure concentration on WISDM
Weak victims limit external validity
Interpretive gap in the sensor-bias framing
No code at review time
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks a mechanism question rather than a strength question: when a smooth, phase-robust adversarial waveform breaks a wearable activity recognizer, is the damage carried by a persistent offset (the per-channel temporal mean, DC) or by time-varying content (the zero-mean residual, AC)? SpectrumAudit (Sec. 3) answers this with a select-then-project design: fit and select a phase-randomized, L-infinity-bounded waveform (T=128, epsilon=0.30 in training-SD units) on unlabeled calibration windows from subjects disjoint from training and test sets, then replay the frozen waveform, its exact DC projection, and a budget-constrained AC residual on the same frozen victim without refitting. Central claims: (1) DC exceeds AC on 24/27 victims and recovers at least 90% of the full drop on 22/27 (Sec. 4.3, Fig. 3a); (2) the audit objective has no attack-strength advantage over pseudo-label CE (+0.07 pp, 95% CI [-0.69, 0.72], p=0.938; Table 1 and the 27-victim replication); (3) the DC-AC gap across nine cell means is 16.95 pp (CI [10.86, 22.06], sign-flip p=0.0078); (4) a held-out UTD-MHAD victim shows a 13.49 pp drop versus -0.66 pp for matched random waveforms.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What does SpectrumAudit do?
SpectrumAudit is a label-free auditing protocol for wearable activity-recognition models. It first selects a smooth, phase-randomized adversarial waveform on unlabeled data from subjects held out of training and testing, then replays that frozen waveform's constant (DC) part and zero-mean (AC) part separately to determine which component carries the accuracy loss.
What is the paper's main finding?
Across 27 victim models from three datasets and three architectures, the constant DC component alone usually caused a larger accuracy drop than the time-varying AC component (24 of 27 models) and recovered at least 90% of the total drop on 22 of 27. The authors interpret this as selected smooth perturbations usually acting like persistent sensor offsets, though all five exceptions occurred on the WISDM dataset.
Is the code for SpectrumAudit available?
Not at the time of this review. The paper states the code will be released upon acceptance, so results currently cannot be verified from artifacts; the datasets (PAMAP2, WISDM, USC-HAD, UTD-MHAD) are public.
Does this mean smooth adversarial examples are not really temporal attacks?
Not universally. The paper shows that under its protocol - a fixed peak budget in standardized units and specific circular phase shifts - selected smooth perturbations usually act through a constant offset. The offset is measured in standardized input units and is not confirmed as a physical sensor bias, and the search itself retains the DC component, which the authors and reviewers flag as a design caveat.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are rendered as garbled text fragments; per-victim bar values in Fig. 3(a) and scatter details in 3(b)-(d) could not be verified.
- Table 2 cell alignment was reconstructed from reflowed text; individual seed values were not independently checkable.
- The extraction appears to cover the full conference-length paper (abstract through references), but any supplementary material would not be visible.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.