{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,25]],"date-time":"2026-02-25T17:11:32Z","timestamp":1772039492581,"version":"3.50.1"},"publisher-location":"Cham","reference-count":51,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783031171420","type":"print"},{"value":"9783031171437","type":"electronic"}],"license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022]]},"DOI":"10.1007\/978-3-031-17143-7_17","type":"book-chapter","created":{"date-parts":[[2022,9,23]],"date-time":"2022-09-23T04:04:22Z","timestamp":1663905862000},"page":"343-363","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Hide and\u00a0Seek: On the\u00a0Stealthiness of\u00a0Attacks Against Deep Learning Systems"],"prefix":"10.1007","author":[{"given":"Zeyan","family":"Liu","sequence":"first","affiliation":[]},{"given":"Fengjun","family":"Li","sequence":"additional","affiliation":[]},{"given":"Jingqiang","family":"Lin","sequence":"additional","affiliation":[]},{"given":"Zhu","family":"Li","sequence":"additional","affiliation":[]},{"given":"Bo","family":"Luo","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,9,24]]},"reference":[{"key":"17_CR1","unstructured":"Bai, H.: Evidence that a large amount of low quality responses on MTURK can be detected with repeated GPS coordinates (2018)"},{"key":"17_CR2","doi-asserted-by":"crossref","unstructured":"Barni, M., Kallas, K., Tondi, B.: A new backdoor attack in CNNs by training set corruption without label poisoning. In: IEEE ICIP (2019)","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"17_CR3","doi-asserted-by":"crossref","unstructured":"Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy (SP), pp. 39\u201357. IEEE (2017)","DOI":"10.1109\/SP.2017.49"},{"key":"17_CR4","unstructured":"Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: Adversarial attacks and defences: a survey. arXiv:1810.00069 (2018)"},{"key":"17_CR5","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv:1712.05526 (2017)"},{"issue":"4","key":"17_CR6","doi-asserted-by":"publisher","first-page":"464","DOI":"10.1177\/1948550619875149","volume":"11","author":"M Chmielewski","year":"2020","unstructured":"Chmielewski, M., Kucker, S.C.: An MTURK crisis? shifts in data quality and the impact on study results. Soc. Psychol. Personality Sci. 11(4), 464\u2013473 (2020)","journal-title":"Soc. Psychol. Personality Sci."},{"key":"17_CR7","unstructured":"Croce, F., Hein, M.: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International Conference on Machine Learning, pp. 2206\u20132216. PMLR (2020)"},{"key":"17_CR8","doi-asserted-by":"crossref","unstructured":"Dabouei, A., Soleymani, S., Taherkhani, F., Dawson, J., Nasrabadi, N.: Smoothfool: an efficient framework for computing smooth adversarial perturbations. In: Proceedings of the IEEE\/CVF Winter Conference on Applications of Computer Vision, pp. 2665\u20132674 (2020)","DOI":"10.1109\/WACV45572.2020.9093429"},{"key":"17_CR9","doi-asserted-by":"crossref","unstructured":"Doan, K., Lao, Y., Zhao, W., Li, P.: Lira: Learnable, imperceptible and robust backdoor attacks. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 11966\u201311976 (2021)","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"17_CR10","doi-asserted-by":"crossref","unstructured":"Dong, Y., et al.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9185\u20139193 (2018)","DOI":"10.1109\/CVPR.2018.00957"},{"key":"17_CR11","unstructured":"Dreyfuss, E.: A bot panic hits amazon\u2019s mechanical Turk. Wired (2018)"},{"key":"17_CR12","doi-asserted-by":"crossref","unstructured":"Dumford, J., Scheirer, W.: Backdooring convolutional neural networks via targeted weight perturbations. In: 2020 IEEE International Joint Conference on Biometrics (IJCB), pp. 1\u20139. IEEE (2020)","DOI":"10.1109\/IJCB48548.2020.9304875"},{"key":"17_CR13","doi-asserted-by":"publisher","first-page":"413","DOI":"10.1016\/j.neucom.2014.09.060","volume":"152","author":"M Fei","year":"2015","unstructured":"Fei, M., Li, J., Liu, H.: Visual tracking based on improved foreground detection and perceptual hashing. Neurocomputing 152, 413\u2013428 (2015)","journal-title":"Neurocomputing"},{"issue":"1","key":"17_CR14","doi-asserted-by":"publisher","first-page":"1","DOI":"10.18637\/jss.v033.i01","volume":"33","author":"J Friedman","year":"2010","unstructured":"Friedman, J., Hastie, T., Tibshirani, R.: Regularization paths for generalized linear models via coordinate descent. J. Stat. Softw. 33(1), 1 (2010)","journal-title":"J. Stat. Softw."},{"key":"17_CR15","unstructured":"Ganin, Y., Lempitsky, V.: Unsupervised domain adaptation by backpropagation. In: International Conference on Machine Learning, pp. 1180\u20131189. PMLR (2015)"},{"issue":"1","key":"17_CR16","first-page":"2030","volume":"17","author":"Y Ganin","year":"2016","unstructured":"Ganin, Y., et al.: Domain-adversarial training of neural networks. J. Mach. Learn. Res. 17(1), 2030\u20132096 (2016)","journal-title":"J. Mach. Learn. Res."},{"key":"17_CR17","unstructured":"Goodfellow, I., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: ICLR (2015)"},{"key":"17_CR18","unstructured":"Gu, T., Dolan-Gavitt, B., Garg, S.: BadNets: identifying vulnerabilities in the machine learning model supply chain. In: NIPS MLSec Workshop (2017)"},{"key":"17_CR19","unstructured":"Guo, W., Wang, L., Xing, X., Du, M., Song, D.: Tabor: a highly accurate approach to inspecting and restoring trojan backdoors in AI systems. In: ICDM (2020)"},{"key":"17_CR20","doi-asserted-by":"crossref","unstructured":"Hosseini, H., Poovendran, R.: Semantic adversarial examples. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 1614\u20131619 (2018)","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"17_CR21","doi-asserted-by":"crossref","unstructured":"Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., Igel, C.: Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. In: IJCNN (2013)","DOI":"10.1109\/IJCNN.2013.6706807"},{"key":"17_CR22","doi-asserted-by":"crossref","unstructured":"Jiang, L., Dai, B., Wu, W., Loy, C.C.: Focal frequency loss for image reconstruction and synthesis. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 13919\u201313929 (2021)","DOI":"10.1109\/ICCV48922.2021.01366"},{"key":"17_CR23","unstructured":"Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images (2009)"},{"key":"17_CR24","unstructured":"Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. In: ICLR Workshop (2017). https:\/\/arxiv.org\/abs\/1607.02533"},{"issue":"5","key":"17_CR25","first-page":"2088","volume":"18","author":"S Li","year":"2020","unstructured":"Li, S., Xue, M., Zhao, B.Z.H., Zhu, H., Zhang, X.: Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Trans. Dependable Secure Comput. 18(5), 2088\u20132105 (2020)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"17_CR26","doi-asserted-by":"crossref","unstructured":"Li, Y., Hua, J., Wang, H., Chen, C., Liu, Y.: Deeppayload: black-box backdoor attack on deep learning models through neural payload injection. In: IEEE\/ACM ICSE (2021)","DOI":"10.1109\/ICSE43902.2021.00035"},{"key":"17_CR27","doi-asserted-by":"crossref","unstructured":"Liu, Y., Lee, W.C., Tao, G., Ma, S., Aafer, Y., Zhang, X.: Abs: scanning neural networks for back-doors by artificial brain stimulation. In: ACM CCS (2019)","DOI":"10.1145\/3319535.3363216"},{"key":"17_CR28","doi-asserted-by":"crossref","unstructured":"Liu, Y., et al.: Trojaning attack on neural networks. In: NDSS (2018)","DOI":"10.14722\/ndss.2018.23291"},{"key":"17_CR29","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: International Conference on Learning Representations (2018)"},{"key":"17_CR30","doi-asserted-by":"crossref","unstructured":"Marnerides, D., Bashford-Rogers, T., Hatchett, J., Debattista, K.: Expandnet: a deep convolutional neural network for high dynamic range expansion from low dynamic range content. In: Computer Graphics Forum.,vol. 37, pp. 37\u201349. Wiley Online Library (2018)","DOI":"10.1111\/cgf.13340"},{"key":"17_CR31","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574\u20132582 (2016)","DOI":"10.1109\/CVPR.2016.282"},{"key":"17_CR32","unstructured":"Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A.Y.: Reading digits in natural images with unsupervised feature learning (2011)"},{"key":"17_CR33","unstructured":"Nguyen, T.A., Tran, A.T.: Wanet-imperceptible warping-based backdoor attack. In: International Conference on Learning Representations (2020)"},{"key":"17_CR34","unstructured":"Northcutt, C.G., Athalye, A., Mueller, J.: Pervasive label errors in test sets destabilize machine learning benchmarks. arXiv preprint arXiv:2103.14749 (2021)"},{"issue":"3","key":"17_CR35","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1007\/s11263-015-0816-y","volume":"115","author":"O Russakovsky","year":"2015","unstructured":"Russakovsky, O., et al.: ImageNet large scale visual recognition challenge. Int. J. Comput. Vision 115(3), 211\u2013252 (2015). https:\/\/doi.org\/10.1007\/s11263-015-0816-y","journal-title":"Int. J. Comput. Vision"},{"key":"17_CR36","doi-asserted-by":"crossref","unstructured":"Saha, A., Subramanya, A., Pirsiavash, H.: Hidden trigger backdoor attacks. In: AAAI (2020)","DOI":"10.1609\/aaai.v34i07.6871"},{"issue":"2","key":"17_CR37","doi-asserted-by":"publisher","first-page":"430","DOI":"10.1109\/TIP.2005.859378","volume":"15","author":"HR Sheikh","year":"2006","unstructured":"Sheikh, H.R., Bovik, A.C.: Image information and visual quality. IEEE Trans. Image Process. 15(2), 430\u2013444 (2006)","journal-title":"IEEE Trans. Image Process."},{"key":"17_CR38","doi-asserted-by":"crossref","unstructured":"Tang, R., Du, M., Liu, N., Yang, F., Hu, X.: An embarrassingly simple approach for trojan attack in deep neural networks. In: ACM KDD (2020)","DOI":"10.1145\/3394486.3403064"},{"key":"17_CR39","unstructured":"Wald, L.: Quality of high resolution synthesised images: is there a simple criterion? In: Third Conference \u201cFusion of Earth Data: Merging Point Measurements, Raster Maps and Remotely Sensed Images\u201d, pp. 99\u2013103. SEE\/URISCA (2000)"},{"key":"17_CR40","doi-asserted-by":"crossref","unstructured":"Wang, B., et al.: Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In: IEEE S &P (2019)","DOI":"10.1109\/SP.2019.00031"},{"issue":"3","key":"17_CR41","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1109\/97.995823","volume":"9","author":"Z Wang","year":"2002","unstructured":"Wang, Z., Bovik, A.C.: A universal image quality index. IEEE Signal Process. Lett. 9(3), 81\u201384 (2002)","journal-title":"IEEE Signal Process. Lett."},{"issue":"4","key":"17_CR42","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang, Z., Bovik, A.C., Sheikh, H.R., Simoncelli, E.P.: Image quality assessment: from error visibility to structural similarity. IEEE Trans. Image Process. 13(4), 600\u2013612 (2004)","journal-title":"IEEE Trans. Image Process."},{"key":"17_CR43","unstructured":"Wang, Z., Simoncelli, E.P., Bovik, A.C.: Multiscale structural similarity for image quality assessment. In: The Thrity-Seventh Asilomar Conference on Signals, Systems & Computers, 2003, vol. 2, pp. 1398\u20131402. IEEE (2003)"},{"key":"17_CR44","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"392","DOI":"10.1007\/978-3-030-67070-2_24","volume-title":"Computer Vision \u2013 ECCV 2020 Workshops","author":"P Wei","year":"2020","unstructured":"Wei, P., et al.: AIM 2020 challenge on real image super-resolution: methods and results. In: Bartoli, A., Fusiello, A. (eds.) ECCV 2020. LNCS, vol. 12537, pp. 392\u2013422. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-67070-2_24"},{"key":"17_CR45","unstructured":"Wong, E., Rice, L., Kolter, J.Z.: Fast is better than free: revisiting adversarial training. In: International Conference on Learning Representations (2019)"},{"key":"17_CR46","unstructured":"Yuhas, R.H., Goetz, A.F.H., Boardman, J.W.: Discrimination among semi-arid landscape endmembers using the spectral angle mapper (sam) algorithm. In: Summaries of the 4th Annual JPL Airborne Geoscience Workshop (1992)"},{"key":"17_CR47","doi-asserted-by":"crossref","unstructured":"Zeng, Y., Park, W., Mao, Z.M., Jia, R.: Rethinking the backdoor attacks\u2019 triggers: a frequency perspective. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, pp. 16473\u201316481 (2021)","DOI":"10.1109\/ICCV48922.2021.01616"},{"issue":"8","key":"17_CR48","doi-asserted-by":"publisher","first-page":"2378","DOI":"10.1109\/TIP.2011.2109730","volume":"20","author":"L Zhang","year":"2011","unstructured":"Zhang, L., Zhang, L., Mou, X., Zhang, D.: FSIM: a feature similarity index for image quality assessment. IEEE Trans. Image Processing 20(8), 2378\u20132386 (2011)","journal-title":"IEEE Trans. Image Processing"},{"key":"17_CR49","doi-asserted-by":"crossref","unstructured":"Zhang, Q., Ding, Y., Tian, Y., Guo, J., Yuan, M., Jiang, Y.: Advdoor: adversarial backdoor attack of deep learning system. In: ACM International Symposium on Software Testing and Analysis (2021)","DOI":"10.1145\/3460319.3464809"},{"key":"17_CR50","doi-asserted-by":"crossref","unstructured":"Zhang, R., Isola, P., Efros, A.A., Shechtman, E., Wang, O.: The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 586\u2013595 (2018)","DOI":"10.1109\/CVPR.2018.00068"},{"key":"17_CR51","doi-asserted-by":"crossref","unstructured":"Zhong, H., Liao, C., Squicciarini, A.C., Zhu, S., Miller, D.: Backdoor embedding in convolutional neural network models via invisible perturbation. In: ACM CODASPY (2020)","DOI":"10.1145\/3374664.3375751"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2022"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-031-17143-7_17","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,23]],"date-time":"2022-09-23T04:09:12Z","timestamp":1663906152000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-031-17143-7_17"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"ISBN":["9783031171420","9783031171437"],"references-count":51,"URL":"https:\/\/doi.org\/10.1007\/978-3-031-17143-7_17","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]},"assertion":[{"value":"24 September 2022","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Copenhagen","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Denmark","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2022","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"26 September 2022","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"30 September 2022","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2022","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/esorics2022.compute.dtu.dk\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"562","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"104","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"6","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3.4","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"12","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}}]}}