TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecasting

Time Series Forecasting (TSF) is highly vulnerable to backdoor attacks, yet effective defenses remain underexplored due to challenges arising from data entanglement and shifts in task formulation. To fill this gap, we conduct a systematic evaluation of thirteen representative backdoor defenses across the TSF life cycle and analyze their failure modes. Our results reveal two fundamental issues: (1) data entanglement induces *channel-level signal dilution*, rendering sample-filtering and trigger-synthesis defenses ineffective at localizing backdoors; and (2) task-formulation shift leads to *training-loss degeneration*, causing poisoned and clean windows to become indistinguishable at training stages. Based on these findings, we propose a training-time backdoor defense for TSF, termed TimeGuard. Our method adopts channel-wise pool training as the core paradigm and initializes a high-confidence pool using time-aware criteria to mitigate signal dilution. Moreover, we introduce distance-regularized loss selection to progressively expand the reliable pool during training and ease loss degeneration. Extensive experiments across multiple datasets, forecasting architectures, and TSF backdoor attacks demonstrate that TimeGuard substantially improves robustness, boosting $\mathrm{MAE}_ \mathrm{P}$ by $1.96\times$ over the leading baseline, while preserving clean performance within 5% $\mathrm{MAE}_ \mathrm{C}$.

Many important time series forecasting systems use past measurements to predict the future, such as in traffic, energy, finance, and healthcare. These systems can be secretly manipulated through backdoor attacks: the model behaves normally most of the time, but produces attacker-chosen predictions when a hidden pattern appears. We ask whether existing defenses against backdoor attacks are effective for time series forecasting, despite its mixed measurements and differences from other machine learning tasks. We first study thirteen common defenses and identify why they often fail in time series forecasting. We then propose TimeGuard, a defense that uses channel-wise training to check each measurement separately instead of treating all measurements together. TimeGuard starts from a set of reliable examples, called a reliable pool, selected using information specific to time series data. TimeGuard then progressively updates this reliable pool during training by selecting examples based on how well the system predicts their future values and how similar they are to trusted examples in the pool. Across various attacks, datasets, and forecasting models, TimeGuard effectively protects forecasting systems against backdoor attacks while keeping normal forecasting performance nearly unchanged. This work provides a step toward safer and more trustworthy forecasting systems in real-world applications.