PRISM-TS: A Personalized Backdoor Defense Method for Power Load Time-Series Classification

1. Introduction

Power load time-series classification is a key foundation for grid monitoring, load-state identification, and operational decisions. In recent years, deep models such as one-dimensional convolutional networks, recurrent networks, and residual networks have been widely used in time-series classification and representation learning [1,2,3,4,5,6]. With the gradual application of such models in load early warning and dispatching auxiliary systems [12,13], the prediction results begin to affect the perception and risk judgment of power grid operation. Model security and reliability are now important concerns.

Training data poisoning can implant hidden time-domain or frequency-domain trigger patterns into load time series [18,19,20,21,22,23]. These triggers enable a model to maintain high classification performance on clean samples, but misjudges the real high-load states as low-load states when the trigger appears [14,15,16,17]. which leads to underestimation of load risk, alarm failure and inaccurate operation decision. The impact of triggers on different network modules may be different : some modules produce more significant response changes under trigger conditions, which may have a greater impact on backdoor prediction ; other modules are mainly responsible for normal load feature extraction and category discrimination. At the same time, it is usually difficult for defenders to obtain the original trigger used by the attacker and its precise configuration. Therefore, how to identify the module-level backdoor risk under limited trusted information and maintain the normal load identification ability while suppressing the backdoor behavior is the key problem faced by the backdoor defense of power load time series.

Existing backdoor defense methods mainly include fine-tuning, knowledge distillation, structural pruning, parameter resetting, and adversarial unlearning [27,28,29,30,31,32,33]. Although some methods perform selective repair based on neuron activations, parameter importance, or structural features, they do not fully exploit the risk differences among modules under triggered conditions. They also rarely apply different purification methods or processing intensities according to module-specific risks. If risk estimation is inaccurate or purification is insufficient, backdoor-related modules may retain malicious behavior. Conversely, overly broad processing may damage normal load representations, reducing clean classification accuracy and high-load state recognition. In addition, some methods rely on known attack samples or trigger information, which limits their applicability when the original trigger configuration is unknown or changes.Therefore, a module-risk assessment mechanism is needed that does not depend on the precise configuration of the original trigger. Such a mechanism should support differentiated purification according to module-specific risks and provide a better balance between backdoor suppression and normal-task preservation.

To tackle these problems, we propose PRISM-TS (Proxy-Trigger-Guided Risk-Aware Personalized Module Purification for Time-Series Models).In this paper, it is set that the defender can access the contaminated load classification model, the trusted clean calibration data and the same structure reference model based on the trusted data training, but it is impossible to obtain the the precise configuration of the attacker’s original trigger. The module-level purification problem of the backdoor model has become the core of the research. Based on this setting, PRISM-TS employs the characteristics of load time series to construct proxy triggers, without using the precise location, amplitude, random seed, or shape parameters of the original trigger. It analyzes the response changes of candidate module combinations under proxy-trigger conditions to estimate module-level backdoor sensitivity, and the key purification module is determined by combining the clean performance constraint. For the selected high-risk modules, the corresponding modules from the clean reference model are replaced to preferentially weaken the potential backdoor-related representations; For the remaining modules, the corresponding parameters of the clean reference model and the backdoored model are integrated with equal weights to reduce damage to normal load representations. Finally, the BatchNorm statistics are reestimated with trusted clean calibration data. This process reduces the feature-statistics shifts due to module purification, and balances backdoor suppression with normal task performance.

The main contributions of this paper are as follows:

1. We propose a framework named PRISM-TS, which is a proxy-triggered backdoor defense method for power load time-series classification. The framework does not need to use the precise configuration of the attacker 's original trigger. Instead, it estimates the module-level backdoor sensitivity based on changes in module responses under proxy-triggered conditions.

2. We propose a module combination search mechanism constrained by clean accuracy and a risk-aware hybrid purification strategy. High-risk modules are replaced with their corresponding modules from a clean reference model, and the remaining modules are fused with equal-weight parameters. This design adjusts the purification range and processing intensity according to the risk differences of each module.

3. We assess the performance of PRISM-TS under random time-domain backdoor attacks on the AEP power load dataset. The evaluation includes backdoor suppression, clean classification performance, and high-load state recognition. PRISM-TS reduces the ASR to 2.53% while keeping a CACC of 95.72% and an HLR of 89.62%. Ablation experiments further confirm the effects of proxy-trigger auditing, module-combination search, and hybrid purification. Moreover, frequency-domain experiments employ frequency-domain proxy triggers for module auditing and purification, as the original frequency-domain trigger configuration is unknown. These experiments assess the defense performance of PRISM-TS under frequency-domain attack settings, which are considered in this study.

2. Related Work

2.1. Power Load Time-Series Classification

Power-load time-series classification analyzes historical electricity consumption data to identify load states, monitor anomalies, and assess operational risks [12,13]. Early load-state identification mainly depends on manually engineered statistical and temporal features. In recent years, it has gradually shifted to automatic representation learning based on deep neural networks. With the development of deep learning, one-dimensional convolutional neural networks, recurrent neural networks, and residual networks have been used to model power load time series. These models can automatically extract features such as local fluctuations, periodic variations, and sequential dependencies [1,2,3]. More recently, the attention mechanism and Transformer structure have further enhanced the model 's ability to model long-term correlation information [7,8,9,10,11].

Existing studies mostly focus on classification accuracy, prediction performance, and feature extraction ability under normal data conditions, but they don't pay much attention to model security risks during training. Even if a deep model performs well on clean test samples, it might learn specific malicious input–output associations if the training data are poisoned. Therefore, it is difficult to judge whether the power load classification model contains potential backdoor behavior only based on the classification performance on normal samples.

2.2. Backdoor Attacks on Time Series

Backdoor attacks establish cover associations between specific trigger patterns and attacker-defined outputs by contaminaing training data or altering the training process [14,15,16]. Consequently, the model maintains normal performance on clean inputs but may produce targeted misclassifications when the trigger is present [9,10,11]. Unlike localized patches in images, time-series triggers can be encoded by their temporal position, duration, perturbation amplitude, variation pattern, or frequency components. They might also be mixed with local fluctuations and periodic changes in the original sequence, making them hard to detect [17,18,19,20].

Previous studies have shown time-series models are vulnerable to backdoor attacks [21,22,23]. For instance, BackTime is oriented to multivariate time-series forecasting and changes model predictions by finding vulnerable time positions and generating covert triggers[23]. Other studies have also revealed how trigger patterns propagate through time-series models and affect their predictions from the perspective of trigger detection, recovery, and interpretability analysis. These studies offer a basis for understanding the backdoor threats of time-series. But they mainly focus on multivariate time-series forecasting, general time-series classification, and backdoor detection. In contrast, the research on backdoor purification for power load state classification is still relatively limited, especially the lack of systematic research on the defense effect under local time domain triggering and frequency domain disturbance conditions.

2.3. Backdoor Defense Methods

Existing backdoor defense methods mostly include trusted-data-based repair, structural screening and pruning, and optimization-based or adversarial unlearning methods. These methods have different requirements for accessing trusted data, model parameters, neuron activations, training samples, and trigger information.

Trusted-data-based repair methods employs clean samples to modify the parameters or internal representations of a backdoored model. Clean Fine-Tuning uses trusted clean date to update model parameters, but it might not be enough to eliminate established backdoor mappings when clean data are limited [27]. Fine-Pruning combines low-activation neuron pruning with fine-tuning on clean data to weaken the influence of backdoor-related structures [27]. Neural Attention Distillation ( NAD ) learns the attention representation on clean samples through the knowledge distillation constraint model, thereby weakening the backdoor response [28]. The effectiveness of these methods relies on the quantity of trusted data, the scope of parameter updates, and the quality of the teacher model.

Structural defenses narrows the purification range by identifying and handling suspicious neurons or channels. Adversarial Neuron Pruning (ANP) uses adversarial perturbations to locate neurons sensitive to backdoor behavior [30]. Reconstructive Neuron Pruning (RNP) identifies suspicious structures by reconstructing neuron functions [33]. Channel Lipschitzness-based Pruning (CLP) performs selective pruning based on the Lipschitz characteristics of the channel [32]. Optimization-based and adversarial unlearning methods adjust model parameters to reduce abnormal associations between triggers and target classes. Implicit Backdoor Adversarial Unlearning (I-BAU) models backdoor purification as a bilevel optimization problem[31]. Anti-Backdoor Learning (ABL) employs the differences in model learning behavior on clean and poisoned samples to identify and weaken malicious associations [29]. ABL mainly operates during training, so it needs access to the corresponding training samples or training dynamics.

These methods are mainly designed for visual classification models. To compare their defense performance on power load time-series models, we adjust the operations of I-BAU, RNP, and CLP to the one-dimensional residual network used in this study. The methods are adapted and used as baseline defenses. This adaptation keeps the main defense mechanisms of the original methods, but the experimental results only assess their applicability to the power load classification task that is considered here. They do not mean that these methods were originally designed for this task.

Existing methods usually screen suspicious units based on clean-sample activations, parameter sensitivity, training dynamics, or structural features. But they seldom use changes in module responses under proxy-trigger conditions to evaluate module-level backdoor sensitivity. Moreover, selected neurons, channels, or parameters are usually processed via the same pruning, resetting, or updating operation. This uniform processing lacks the ability to differentiate the roles of different modules in the context of backdoor behavior and normal load representations.Under the defense setting in this paper, the defender can construct proxy-trigger patterns based on task-specific prior knowledge, but can not get the precise location, amplitude, and shape of the original trigger. Clean-sample information or structural statistics alone might not be enough to determine which modules are more sensitive to trigger conditions. If the purification scope is too narrow, residual backdoor responses might still be present. If all modules are processed with the same intensity, normal load representations might be damaged. Therefore, this study estimates the module-level backdoor sensitivity by analyzing proxy-trigger responses and selecting purification modules and purification intensity based on estimated module risks, without relying on the exact configuration of the original trigger.

3. Methodology

3.1. Power Load Time-Series Classification Task

Given a prediction time step t, construct the input window by using the historical multi-feature sequence from the previous T time steps:

$${\mathrm{x}}_{\mathrm{t}}=[{\mathrm{z}}_{\mathrm{t}-\mathrm{T}},{\mathrm{z}}_{\mathrm{t}-\mathrm{T}+1},\dots ,{\mathrm{z}}_{\mathrm{t}-1}]\in {\mathbb{R}}^{\mathrm{C}\times \mathrm{T}}.$$

(1)

In this study, the historical window length is set to T=168, meaning that data from the past 168 hours are used to predict the load state at the next time step. Each time step includes five input features: normalized load value, sine and cosine encodings of the hour-of-day cycle, and sine and cosine encodings of the day-of-week cycle; thus, C=5.

The power load classification model is defined as:

$${\mathrm{f}}_{\mathsf{\theta }}:{\mathbb{R}}^{\mathrm{C}\times \mathrm{T}}\to \mathcal{Y},\hspace{1em}\hspace{1em}\mathcal{Y}=\{\mathrm{0,1},2\}.$$

(2)

where$\mathsf{\theta }$ represents the model parameters, and classes 0, 1, and 2 correspond to the low-load, normal-load, and high-load states, respectively. The labels are determined by quantile thresholds, which are computed from the training-set load values. The labels are determined using quantile thresholds computed from the training-set load values. Let${\mathrm{q}}_{1/3}$and${\mathrm{q}}_{2/3}$ denote the lower and upper tertiles of the training-set load values, respectively. The class label${\mathrm{y}}_{\mathrm{t}}$ at prediction time$\mathrm{t}$ is then defined as:

$${\mathrm{y}}_{\mathrm{t}}=\left\{\begin{array}{c}0,{\mathrm{l}}_{\mathrm{t}}<{\mathrm{q}}_{1/3},\\ 1,{\mathrm{q}}_{1/3}\le {\mathrm{l}}_{\mathrm{t}}<{\mathrm{q}}_{2/3},\\ 2,{\mathrm{l}}_{\mathrm{t}}\ge {\mathrm{q}}_{2/3}.\end{array}\right.$$

(3)

Here,${\mathrm{l}}_{\mathrm{t}}$ represents the actual load value at the prediction time t.

This paper employs a one-dimensional residual network to classify load states. The network consists of eight residual blocks, and each residual block contains two convolutional submodules, denoted by B$\left(\mathrm{i}\right)$-C1 and B$\left(\mathrm{i}\right)$-C2, where $\mathrm{i}=1,\dots ,8$. Each convolutional submodule and its corresponding batch normalization layer are treated as an indivisible candidate module. Therefore, the network contains 16 candidate modules for the subsequent module-level auditing and purification.

3.2. Backdoor Attack and Defense Objectives

Let ${\mathrm{f}}_{{\mathsf{\theta }}_{\mathrm{b}}}$ denote the backdoored model to be purified, and let ${\mathrm{f}}_{{\mathsf{\theta }}_{\mathrm{c}}}$ denote a clean reference model with the same architecture. Here, ${\mathsf{\theta }}_{\mathrm{b}}$ and ${\mathsf{\theta }}_{\mathrm{c}}$ represent the parameters of the backdoored model and the clean reference model, respectively.During training process, the attacker injects a temporal trigger into a subset of high-load samples and changes their labels to the low-load class. Therefore, the backdoored model maintains high classification performance on clean samples, but it misclassifies high-load states as low-load states when the trigger is present.

This paper studies a targeted backdoor attack from the high-load class to the low-load class [14,15,21,22]. Let ${\mathrm{T}}_{\mathrm{a}}(\cdot )$ denote the attacker's original trigger. The source and target classes are denoted by ${\mathrm{y}}_{\mathrm{s}}=2$ and ${\mathrm{y}}_{\mathrm{t}}=0$, respectively. The objective of the backdoor attack is formulated as follows.

$${\mathrm{f}}_{{\mathsf{\theta }}_{\mathrm{b}}}\left({\mathrm{T}}_{\mathrm{a}}\right(\mathrm{x}\left)\right)={\mathrm{y}}_{\mathrm{t}},\hspace{1em}\hspace{1em}\mathrm{y}\left(\mathrm{x}\right)={\mathrm{y}}_{\mathrm{s}}.$$

(4)

The defender has access to a backdoored model to be purified, a clean reference model with the same architecture trained on complete trusted training data, and a trusted clean training window for BatchNorm calibration. But during module auditing, module-combination search, and purification-parameter selection of PRISM-TS, the defender lacks the exact location, perturbation amplitude, random seed, and encoding scheme of the attacker’s original trigger.To prevent using the same samples for module selection and evaluation, this paper divides the validation period into two subsets in chronological order. The first 60% is employed as the validation selection set for candidate module-combination search and rechecking under proxy-trigger conditions. The remaining 40% is designated as the post-selection evaluation set. This set is only used after the module set, parameter-fusion method, and BatchNorm calibration procedure have been determined. The attacker's original trigger is applied according to the evaluation protocol to compute the defense metrics. The original trigger is not employed for module localization, candidate ranking, hyperparameter selection, and model updating in PRISM-TS.

During the training of the base classification model, the complete validation period is employed to evaluate the classification performance and determine the optimal checkpoint. Therefore, the post-selection evaluation set is only independent of the defense decision process. It is not completely unseen during base-model training. BatchNorm running statistics are only reestimated using the trusted clean window of the training period. The test set is not employed for model training, module selection, and any other purification decisions. After the final defense model is determined, it is only used for final evaluation with the attacker’s original trigger according to the experimental evaluation protocol.This paper aims to reduce the attack success rate ( ASR ) while maintaining clean classification accuracy ( CACC ) and high load retention rate ( HLR ).The primary objective is to reduce the attack success rate (ASR) while maintaining clean accuracy (CACC) and the high-load retention rate (HLR).

The overall framework of PRISM-TS is shown in Figure 1.

3.3. Proxy-Trigger-Guided Joint Module Selection

Because the defender can not get the precise location, perturbation amplitude, and encoding pattern of the attacker’s original trigger, we create a random zigzag proxy trigger based on the known local time-domain trigger type for module auditing. The proxy trigger does not replicate the original attacker's encoding scheme. Instead, it employs alternating positive and negative perturbations within a local time period. Its length is fixed at 8 hours, and its injection position is shifted forward by at most 18 hours relative to the input window. The perturbation amplitude is randomly sampled between 1.5% and 3.5%. The proxy trigger is only used to evaluate the suppression effect of the candidate module combination on the trigger response. It is employed for module auditing and candidate-combination selection, but not for replicating the attacker's precise attack process. After the module combination is determined, the attacker's original trigger is employed for the final defense evaluation the post-selection evaluation set and the test set.

Let S denote a candidate module combination to be purified, and let ${\mathrm{f}}_{{\mathsf{\theta }}_{\mathrm{S}}}$ denote the candidate model obtained after module purification and BatchNorm statistic recalibration based on S. Let ${\mathrm{D}}_{\mathrm{p}}$ denote the set of proxy-triggered samples from the source class y_s, and let ${\mathrm{T}}_{\mathrm{p}}(\cdot )$ denote the proxy trigger. The proxy attack success rate of the candidate model is defined as follows:

$${\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathcal{S}}^{\mathrm{p}}={\displaystyle \frac{1}{\left|{\mathcal{D}}_{\mathrm{p}}\right|}}{\sum }_{(\mathrm{x},{\mathrm{y}}_{\mathrm{s}})\in {\mathcal{D}}_{\mathrm{p}}}\mathbb{I}\left[{\mathrm{f}}_{{\mathsf{\theta }}_{\mathcal{S}}}\left({\mathcal{T}}_{\mathrm{p}}\right(\mathrm{x}\left)\right)={\mathrm{y}}_{\mathrm{t}}\right].$$

(5)

Here, $\mathbb{I}[\cdot ]$ denotes the indicator function. Its value is 1 when the condition in brackets is satisfied and 0 otherwise.

Let $\mathrm{A}\mathrm{S}{\mathrm{R}}_{\mathrm{b}}^{\mathrm{p}}$ denote the attack success rate of the backdoored model on the proxy-triggered samples, and let $\mathrm{C}\mathrm{A}\mathrm{C}{\mathrm{C}}_{\mathrm{b}}$ denote its clean accuracy. The reduction in proxy attack success rate and the change in clean accuracy for candidate module combination $\mathrm{S}$, relative to the backdoored-model baseline, are defined as follows:

$$\begin{gathered} \mathsf{\Delta }{\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathcal{S}}^{\mathrm{p}}={\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathrm{b}}^{\mathrm{p}}-{\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathcal{S}}^{\mathrm{p}}, \\ \mathsf{\Delta }{\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathcal{S}}={\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathrm{b}}-{\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathcal{S}}. \end{gathered}$$

(6)

All indicators are calculated as proportions. For example, a 3-percentage-point decrease in clean accuracy corresponds to$\mathsf{\Delta }{\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathrm{S}}=0.03$.

To balance the gain of backdoor suppression and the loss of clean classification performance, the security–utility score of candidate module combination \(S\) is defined as

$$\mathrm{R}\left(\mathrm{S}\right)=\mathsf{\Delta }{\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathrm{S}}^{\mathrm{p}}-{\mathsf{\lambda }}_{\max }\left(\mathsf{\Delta }{\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathrm{S}},0\right).$$

(7)

where $\mathsf{\lambda }$ is the penalty coefficient for the loss of clean accuracy. Before the start of the experiment, $\mathsf{\lambda }$ is fixed at 2 and remains unchanged during module search and candidate rechecking. It is not adjusted according to validation results. A higher $\mathrm{R}\left(\mathrm{S}\right)$ indicates a larger reduction in proxy attack success rate with a smaller loss of clean accuracy.

This paper does not directly select the top-k modules based on their individual risk scores. Instead, it performs a joint module search to evaluate whether purifying multiple modules together is more effective than just purifying a single module.First, all single modules and two-module combinations are evaluated. Among the two-module combinations that meet the clean-accuracy constraint, the six combinations with the highest security–utility scores are chosen as search seeds. Candidate modules are greedy extended from each seed, with a maximum number of modules of 4. Each candidate combination must meet the following criteria:

$$\mathsf{\Delta }{\mathrm{C}\mathrm{A}\mathrm{C}\mathrm{C}}_{\mathcal{S}}\le 0.03,\hspace{1em}\hspace{1em}\mathsf{\Delta }{\mathrm{A}\mathrm{S}\mathrm{R}}_{\mathcal{S}}^{\mathrm{p}}\ge 0.01,\hspace{1em}\hspace{1em}\mathrm{R}\left(\mathcal{S}\right)>0.$$

(8)

After the rapid screening, the 20 candidate combinations with the highest security–utility scores are recalibrated the BatchNorm statistics with more trusted clean training windows, and then rechecked.. Finally, the feasible combinations with the highest score after rechecking is selected as the key purification module set S*.The proxy trigger is only used for module risk auditing and candidate combination selection.. After the module combination is determined, the attacker’s original trigger is only used to verify independent defense evaluation the audit set and the test set.

3.4. Personalized Hybrid Purification

For the final selected module combination, PRISM-TS adopts differentiated purification strategies based on module risk. For the selected high-risk modules, we directly use the parameters of the corresponding modules in the clean reference model. For the remaining modules, the corresponding parameters in the clean reference model and the backdoored model are fused with equal weights. The parameters of the $\mathrm{m}$-th module in the final purification model are defined as:

$${\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{p}}=\left\{\begin{array}{c}{\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{c}},\mathrm{m}\in {\mathrm{S}}^{\mathrm{*}},\\ {\displaystyle \frac{1}{2}}{\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{b}}+{\displaystyle \frac{1}{2}}{\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{c}},\mathrm{m}\notin {\mathrm{S}}^{\mathrm{*}}.\end{array}\right.$$

(9)

Here, ${\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{p}}$, ${\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{b}}$, and ${\mathsf{\theta }}_{\mathrm{m}}^{\mathrm{c}}$ denote the parameters of the $\mathrm{m}$-th module in the purification model, the backdoored model, and the clean reference model, respectively. For each selected module, the convolutional layers and the corresponding BatchNorm layers are replaced with the parameters of the clean reference model.

This differentiated strategy applies direct replacement to selected high-risk modules and equal-weight parameter fusion to the remaining modules. It therefore adjusts the purification operation according to module risk while reducing disruption to the normal load representations encoded by the unselected modules.

After the module-parameter replacement and fusion, the model's internal feature statistics are recalibrated to reduce the effect of parameter purification on the running statistics of BatchNorm. Specifically, the running mean and variance of each BatchNorm layer are first reset. The model then use the trusted clean calibration window from the training time period for forward propagation, and the BatchNorm running statistics are re-estimated based on the resulting feature statistics. The module search phase uses up to 20 calibration batches to reduce the computational overhead of candidate combination screening. Up to 200 calibration batches are adopted during candidate rechecking and final model construction phase.

4. Experiments and Result Analysis

This section assesses the defense performance of PRISM-TS and its key mechanisms. First, we compare PRISM-TS with representative defense methods under random time-domain backdoor attacks. Next, we conduct ablation experiments and compare module selection strategies to evaluate the impact of proxy-trigger auditing, joint module search, and hybrid purification defense performance. Finally, the method is tested under various trigger intensities and frequency-domain trigger conditions.

4.1. Experimental Setup

The experiment employs the AEP hourly power-load dataset. The data are divided chronologically into training, validation, and test sets at a ratio of 70%, 15%, and 15%,respectively. Each sample contains the load values and time-encoding features of 168 hours before the prediction time and is used to predict the load state at the next time step. Based on the lower and upper quartiles of the load values in the training period, samples are classified into three classes: low load, normal load, and high load. The first 60% of the validation period is used for module-combination search and candidate rechecking during the defense phase. The remaining 40% is reserved for independent evaluation after the module combination and purification parameters have been determined.

The attack protocol follows Section 3.2. Module auditing, joint module search, and personalized purification in PRISM-TS follow Section 3.3 and Section 3.4. We use a targeted backdoor attack from high load to low load. The random time-domain trigger has a length of 8 hours and a perturbation amplitude of 2%–4%; the maximum temporal offset is 12 hours, the poisoning ratio is 10%, and the attack seed is fixed at 42. During the defense phase, random zigzag proxy triggers are used for module auditing, combination search, and candidate rechecking. After the defense model is determined, the attacker’s original trigger is used for final evaluation on the post-selection evaluation set and the test set.

To illustrate the two trigger forms considered in this study, Figure 2 shows examples of a random time-domain trigger and a random frequency-band trigger applied to the same load sample. The upper panels show the triggered load sequences, while the lower panels show the corresponding perturbations.

To compare different backdoor purification strategies, we select Clean Fine-Tuning, NAD, Fine-Pruning, ANP, I-BAU, ABL, RNP, and CLP as representative defense baselines. The pruning ratio of Fine-Pruning is set to 40%. All methods use the same data partition, attack target, test set, and evaluation protocol. PRISM-TS requires the defender to have a clean reference model with the same architecture and trusted clean calibration data, whereas some conventional baselines use only the trusted data or training information required by their original procedures. Therefore, Table 1 only compares the actual defense effects of each method under the experimental settings in this paper, which does not mean that they use the same information resources.

This paper adopts three evaluation metrics: Clean Classification Accuracy (CACC), Attack Success Rate (ASR), and High-Load Retention Rate (HLR). CACC reflects the model’s classification accuracy on clean samples; ASR represents the proportion of triggered samples predicted as the target class; and HLR measures the proportion of samples originally belonging to the high-load class that are still correctly identified as high-load after the trigger is applied. Higher CACC and HLR values indicate better normal classification performance and higher-load identification performance of the model; a lower ASR indicates stronger backdoor suppression. Unless otherwise specified, all experimental results are the mean and standard deviation of the actual independent runs of each method.

4.2. Overall Defense Performance

Under the random time-domain backdoor attack, we compare the overall performance of different defense methods. The results are shown in Table 1. The conventional defense methods maintain high clean classification accuracy, with CACC ranging from 95.11% to 96.84%. However, their ASR remains high, ranging from 98.89% to 99.97%, whereas HLR is only 0.02%–0.24%. These results indicate that although conventional methods such as fine-tuning, distillation, pruning, and adversarial unlearning preserve classification performance on clean samples, they have difficulty suppressing targeted misclassification under trigger conditions while retaining high-load state recognition.

To compare the performance of various baselines on the one-dimensional residual network described in this paper, we adapted them according to the original mechanisms of classic defense methods. ABL starts with a randomly initialized model and performs sample isolation and anti-learning on a training set containing 10% poisoned samples. I-BAU starts from a fixed backdoor model. It uses 10% of the trusted clean training set for adversarial unlearning and generates generic perturbations during training, enabling the model to learn from both clean and perturbed samples simultaneously. RNP also operates based on a fixed backdoor model. It first performs gradient-ascending neuron unlearning using a trusted clean training subset, then learns a BatchNorm channel restoration mask, prunes some channels based on the mask scores, and finally determines the result from among candidate pruning ratios that satisfy the clean accuracy constraint. CLP requires no additional training steps. This method calculates Lipschitz anomaly scores based on channel statistics from one-dimensional convolutional layers and BatchNorm layers, and uses the first 60% of the validation set to determine the pruning threshold. The remaining 40% of the validation set and the test set are not involved in the defense process selection; they are used solely for final evaluation.

Comparatively, PRISM-TS achieves a CACC of 95.72%, reduces the ASR to 2.53% and raises the HLR to 89.62%. Compared to conventional baselines, PRISM-TS only results in a minor decrease in clean classification performance, while significantly reducing the attack success rate and maintaining a high level of high-load state recognition. In this experiment, applying differentiated purification across modules enables a balance between backdoor suppression and normal-task performance.

Under the current random time-domain backdoor attack, the ASR of conventional defense baselines is usually close to 100%. This shows that although these methods maintain high clean classification accuracy, but they do not well weaken the malicious association between high-load samples and low-load target class. Existing methods typically screen and refine model structures based on low-activity neurons, anomalous channels, or uniform processing rules. But these criteria might not be the best fit for the one-dimensional load residual network and the local time-domain trigger considered in this study. Local perturbations may propagate through multiple convolutional modules, resulting in the backdoor response being distributed across many structures instead of being concentrated in a few channels that can be directly pruned. Conversely, if the model repair is too broad, it might damage the normal load discrimination. Therefore, under the attack setting considered here, conventional baselines have difficulty simultaneously suppressing backdoor and preserving high-load state recognition. This conclusion is only applicable to the experimental setting of this study, and it does not mean these methods are ineffective for all time-series tasks.

4.3. Ablation Analysis Under Different Trigger Amplitudes

To analyze the impact of proxy-trigger auditing and risk-aware hybrid purification, we examine three configurations: the complete PRISM-TS; a configuration without proxy-trigger auditing, which employs random module selection (w/o Proxy Audit); and a configuration that replaces risk-aware hybrid purification with uniform module replacement (w/o Hybrid Purification). All three configurations are based on the same backdoor model with an attack seed of 42. They also employ the same data split, test set, and trigger intensities, as well as BatchNorm calibration settings. Therefore, the only differences among the configurations are the module selection and purification strategies.

Figure 3 shows the experimental results for the three ablation configurations under different trigger intensities. It can be observed that the CACC values for the three configurations fluctuate only slightly, at 95.72%, 96.03%, and 93.74%, respectively. This indicates that these ablation settings have a minimal impact on classification performance on clean samples and primarily affect the defense effectiveness under trigger conditions. At a trigger strength of 0.04, PRISM-TS achieved an ASR of 10.77%, far outperforming the two ablation groups; The ASR values for w/o Proxy Audit and w/o Hybrid Purification were 79.64% and 79.02%, respectively; The HLR of the full model achieved 78.99%, while the two ablation configurations reached only 15.45% and 18.55%, respectively. When the trigger intensity was increased to 0.05, the destructive capability of the backdoor attack intensified, and the defensive effectiveness of all approaches declined. However, PRISM-TS’s ASR was kept at 35.21%, which was still lower than the 97.15% for w/o Proxy Audit and the 89.43% for w/o Hybrid Purification; Its HLR was 56.77%, significantly higher than the 2.28% and 9.23% observed in the two ablation configurations.

As the trigger intensity increases, the defense performance of PRISM-TS decreases gradually. When the intensity increases from 0.05 to 0.06, its ASR goes from 35.21% to 63.34%, and its HLR decreases from 56.77% to 31.66%. At intensities of 0.07 and 0.08, ASR increases to 79.83% and 89.13%, while HLR decreases to 17.15% and 8.90%, respectively. These results indicate that PRISM-TS cannot completely resist high-intensity triggers. Its main advantage is that it achieves lower ASR and higher HLR at low and moderate trigger intensities, rather than maintaining a low ASR under strong attacks. Meanwhile, CACC is almost unchanged, suggesting that the performance degradation is mainly reflected in an increase in targeted misclassification among the triggered samples, rather than a general loss of clean-sample classification ability.

Without proxy-trigger auditing, random module selection cannot reliably identify module combinations that are more sensitive to proxy-trigger responses and more effective for backdoor suppression. Without risk-aware hybrid purification, the uniform module replacement cannot be applied for different purification operations based on module risk. Therefore, both ablation configurations exhibit a faster rate of increase in ASR and a faster rate of decrease in HLR as the trigger intensity increases. PRISM-TS achieves lower ASR and higher HLR at low and moderate trigger intensities. As the intensity increases, its defense performance decreases significantly, maybe because strong perturbations activate residual backdoor responses in modules that are not directly replaced.

4.3.1. Comparison of Joint Module Selection Strategies

To evaluate how the module-selection strategy affects defense performance, we consider four strategies: Lowest-risk, Random, Highest single-module score, and the joint module search used by PRISM-TS. Each strategy selects four modules and uses the same purification strategy, equal-weight parameter-fusion coefficient, trusted clean calibration data, and BatchNorm statistic recalibration procedure. The only difference is how the modules to be purified are determined.Lowest-risk selects the four modules with the lowest proxy-risk scores. Random randomly selects four modules from the same candidate space. Highest single-module score selects the four modules with the highest individual proxy-risk scores. PRISM-TS determines the module combination through joint search under a clean-accuracy constraint.The results are reported as the mean ± standard deviation across three independent module-selection runs using the same fixed backdoored model.

As shown in Figure 4, the CACC, ASR, and HLR of PRISM-TS are 95.72%, 2.53%, and 89.62%, respectively. While maintaining high clean classification accuracy, PRISM-TS achieves the lowest ASR and the highest HLR. Compared with Highest single-module score, PRISM-TS has a CACC that is only 0.17 percentage points lower, but its ASR is further reduced by 3.33 percentage points and its HLR is increased by 4.01 percentage points. This indicates that selecting modules according to individual proxy-risk scores may provide some purification benefit, but does not capture the interaction effects among multiple jointly purified modules.Compared with Random, PRISM-TS reduces the ASR from 29.86% ± 3.28% to 2.53% and increases the HLR from 53.95% ± 3.64% to 89.62%. Lowest-risk achieves an ASR of 64.58% and an HLR of 26.97%, indicating that low risk at the individual-module level does not necessarily imply that the resulting module combination can effectively suppress the backdoor. Except for Random, the other three strategies produce the same results in all three independent constructions; consequently, their standard deviations are 0.00. Under the experimental settings of this study, joint module search is more effective than single-module ranking or random selection in simultaneously reducing ASR and preserving high-load state recognition.

4.4. Robustness Under Different Trigger Intensities

To evaluate the robustness of various defense strategies to changes in trigger intensity, we fixed the corresponding backdoored model, defended model, selected modules, purification parameters, data partitioning, and evaluation protocol for each method. Only the random time-domain trigger's perturbation amplitude was varied at test time. The backdoored model was built with attack seed 42, and in the subsequent experiments, neither the backdoored model nor any defended model was retrained.For each trigger intensity, random time-domain trigger instances were generated with trigger-generation seeds 42, 43, and 44. We present the mean and standard deviation values for CACC, ASR, and HLR. Therefore, the reported standard deviations only account for variation across test-time trigger instances.

As shown in Figure 5, when the perturbation amplitude was 0.01, the ASR of the classical defense methods was between 12.88% and 41.92%, and their HLR was between 39.86% and 79.08%; PRISM-TS had an ASR of 0% and an HLR of 98.12%. When the amplitude reached 0.02, the ASR of all classical defence methods was at least 92.67%, and their HLR did not exceed 1.65%; PRISM-TS still had an ASR of 0% and an HLR of 96.41%.

As the trigger amplitude increases from 0.03 to 0.08, the ASR of PRISM-TS increases from 1.03% to 89.13%, and its HLR decreases from 91.42% to 8.90%. Therefore, PRISM-TS also shows degraded defense performance at high trigger intensities, and cannot fully suppress the backdoor response. But at low-to-moderate intensities, the increase in ASR and the decrease in HLR occur later, suggesting better resistance to changes in trigger intensity compared to classical defense methods. In contrast,when the perturbation amplitude reaches 0.04 or more, the ASR of classical methods is nearly 100%, and their HLR is nearly 0%. The CACC of all methods varies only slightly with trigger amplitude. In the tested range, it shows that trigger intensity mainly affects the backdoor response for triggered samples, not the classification performance on clean samples.

4.5. Defense Performance Under Frequency-Domain Backdoor Attacks

To assess the defense ability of PRISM-TS against frequency-domain backdoor attacks, we examine two types of triggers: one fixed-frequency and one random-frequency-band trigger. A corresponding frequency-domain backdoor model is trained for each attack type. The fixed-frequency trigger is used at frequency indices 17 and 29, while the random-frequency-band trigger randomly selects perturbation frequencies from the two bands, 14–20 and 26–32. For both attacks, the model input is a 168-hour historical window. The poisoning ratio is set at 10%, and the perturbation amplitude is between 2% and 4%.

During the defense process, PRISM-TS does not use the attacker's original frequency-domain trigger for module localization. Instead, it uses proxy triggers at different frequency positions to perform module auditing and joint module search. This paper selects proxy frequencies from a predefined set, such as ( 12,34 ), ( 11,35 ) and ( 13,33 ), and these frequencies do not fall within the fixed frequency point or random frequency band range used by the attacker. For each frequency domain attack, this paper performs module localization, candidate review, differentiated module purification, and BatchNorm statistics reassessment under three proxy seeds. The attacker 's original trigger is only used for subsequent evaluation and final testing.

Table 2 demonstrates that PRISM-TS maintains a low ASR under both frequency domain attacks, while maintaining a high CACC and HLR. Under fixed-frequency attack, the ASR was 0.34 % ± 0.32 %, and the HLR was 93.77 % ± 2.26 %. Under random band attack, ASR is 0.36 % ± 0.41 %, and HLR is 95.45 % ± 0.90 %. By comparison, Fine-Pruning, NAD and I-BAU are still higher ASR or lower HLR under both attacks. These results suggest that the frequency-domain backdoor response under the test conditions in this paper can be reduced by using frequency-domain proxy triggers for module sensitivity auditing, joint module selection and risk-aware purification, even if the specific configuration of the original frequency-domain trigger is unknown. It should be noted that this section re-executed the proxy auditing, module selection and model purification for each frequency-domain attack and verified the adaptive defense capability of PRISM-TS against frequency-domain attacks; it did not directly transfer the defense model obtained in the time-domain attack experiment to the frequency-domain attacks.

5. Conclusions

To address targeted backdoor attacks against power-load time-series classification models, we propose PRISM-TS, a personalized defense method guided by proxy triggers. The method assumes that the defender has access to a clean reference model with the same architecture and trusted clean calibration data, but not to the precise configuration of the attacker’s original trigger. Based on the known trigger form, PRISM-TS constructs proxy triggers and uses them to audit the sensitivity of network modules. It then determines the modules to be purified through joint module search under a clean-accuracy constraint. The selected modules are replaced with the corresponding parameters from the clean reference model, and the parameters of the unselected modules are obtained by equal-weight fusion of the clean and backdoored models. Finally, the BatchNorm running statistics are recalibrated using trusted clean training windows.

In the random time-domain attack experiments on the AEP dataset, PRISM-TS reduced the ASR to 2.53% while maintaining a CACC of 95.72% and an HLR of 89.62%. The ablation results show that removing proxy-trigger auditing or replacing hybrid purification with uniform module replacement leads to higher ASR and lower HLR. These results indicate that both components contribute to the defense performance under the tested conditions.Additional experiments with fixed-frequency and random-frequency-band attacks show that PRISM-TS can still obtain low ASR and high HLR when the precise configuration of the attacker’s original frequency-domain trigger is unavailable. In these experiments, frequency-domain proxy triggers located outside the attack frequency ranges were adopted for module auditing, joint module selection, and purification. Accordingly, proxy-trigger auditing and risk-aware hybrid purification showed effectiveness under the frequency-domain attack conditions evaluated in this study.The conclusions are limited to the AEP dataset, the selected network architecture, the availability of a clean reference model, and the trigger forms examined in this work. They therefore do not establish that PRISM-TS is effective against all unknown attacks. Future work will evaluate the method on additional datasets, architectures, and adaptive attack settings, and will investigate defense strategies that do not require a complete clean reference model.