Imagine you're a piano tuner. You walk into a concert hall and someone has detuned every key by the same fraction of a semitone — a constant offset. Separately, someone else has added random wobble to the hammers. Which sabotage is harder to play through? The wobble is annoying but musicians adapt mid-phrase. The uniform shift is devastating: every chord sounds wrong in the same way, and there's no within-performance signal that something is off. That's the core finding of SpectrumAudit: for wearable activity recognition models, the DC component of an adversarial perturbation — the persistent sensor offset — does almost all the damage, while the fancy time-varying residual barely matters. The committed claim: a label-free auditing method can diagnose whether a HAR model's vulnerability comes from sensor bias (DC offset) or temporal variation (AC residual), without ever touching labels during the audit itself. SpectrumAudit fits a phase-randomized full-window stimulus on calibration data from held-out subjects, then replays its decomposed DC and AC parts separately on the frozen victim model. Across 27 model-dataset combinations spanning three datasets (UCI-HAR, WISDM, UTD-MHAD) and three backbones, DC alone recovers at least 90% of the full perturbation's damage on 22 of 27 victims. The raw accuracy drops range from 2.87 to 40.83 percentage points. The architecture is straightforward and deliberate. The audit generates a single perturbation waveform, decomposes it via spectral methods into its DC projection (constant offset) and budget-constrained zero-mean AC residual, then replays each component independently on a frozen model. No gradient access to the victim is needed at replay time — the stimulus is pre-selected on separate calibration windows. This makes the method a black-box replay audit, closer to a diagnostic stress test than a traditional adversarial attack. The three backbone architectures tested — likely CNN, LSTM, and Transformer variants across the three datasets — provide reasonable diversity but not exhaustive coverage. The integrity story is mixed. On the positive side, the decomposition into DC vs. AC is clean and the experimental protocol — held-out subjects for calibration, separate held-out subjects for testing, frozen victim models — is well-structured to avoid circularity. The 27-victim matrix (3 datasets × 3 backbones × 3 phases) provides breadth. The held-out UTD-MHAD generalization check (13.49-pp accuracy loss vs. -0.66 pp for matched random noise) is a genuine out-of-distribution sanity check. On the negative side, there's no pre-registration, code is promised upon acceptance but not yet released, no independent replication exists, and the three datasets are all well-trodden HAR benchmarks — none involves real deployment-condition sensor data with natural drift. The practical implication hits harder than the academic framing suggests. If DC offset dominates adversarial vulnerability, then the real-world attack surface for wearable HAR is not sophisticated signal injection — it's mundane sensor calibration drift, manufacturing tolerances, and aging. A fitness tracker whose accelerometer drifts 0.05g over six months may silently degrade activity recognition in exactly the way SpectrumAudit diagnoses. This reframes adversarial robustness for HAR: you may not need fancy temporal defenses if you can't even handle a constant bias. The WISDM failures are telling. All 5 cases where DC did not recover 90% of the full drop occurred on WISDM, which is a smartphone-based dataset with noisier, more variable sensor characteristics. This suggests the DC-dominance finding may be architecture-dependent or sensor-quality-dependent — a qualification the authors note but don't deeply explore. The next obvious experiment is testing on newer IMU-based datasets from actual wearable deployments (e.g., Capture-24, UK Biobank accelerometry) and against robustness-hardened models. The missing experiment is the defensive one: if DC offset is the dominant vulnerability, does simple DC-offset augmentation during training close the gap? This is cheap, obvious, and would either validate the diagnostic as actionable or reveal that the vulnerability is more subtle than the decomposition suggests. My read: the authors are saving this for the follow-up paper, since a diagnostic tool that also prescribes the fix is a cleaner two-paper arc than cramming both into one.
