{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T16:27:39Z","timestamp":1771950459165,"version":"3.50.1"},"reference-count":102,"publisher":"Springer Science and Business Media LLC","issue":"6-7","license":[{"start":{"date-parts":[[2019,3,22]],"date-time":"2019-03-22T00:00:00Z","timestamp":1553212800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2019,6]]},"DOI":"10.1007\/s11263-019-01160-w","type":"journal-article","created":{"date-parts":[[2019,3,22]],"date-time":"2019-03-22T12:02:57Z","timestamp":1553256177000},"page":"719-742","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":105,"title":["Detecting and Mitigating Adversarial Perturbations for Robust Face Recognition"],"prefix":"10.1007","volume":"127","author":[{"given":"Gaurav","family":"Goswami","sequence":"first","affiliation":[]},{"given":"Akshay","family":"Agarwal","sequence":"additional","affiliation":[]},{"given":"Nalini","family":"Ratha","sequence":"additional","affiliation":[]},{"given":"Richa","family":"Singh","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5952-2274","authenticated-orcid":false,"given":"Mayank","family":"Vatsa","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2019,3,22]]},"reference":[{"key":"1160_CR1","unstructured":"Addad, B., Kodjabashian, J., & Meyer, C. (2018). Clipping free attacks against artificial neural networks. arXiv preprint arXiv:1803.09468 ."},{"key":"1160_CR2","doi-asserted-by":"crossref","unstructured":"Agarwal, A., Singh, R., & Vatsa, M. (2016). Face anti-spoofing using haralick features. In 2016 IEEE 8th international conference on biometrics theory, applications and systems (pp. 1\u20136).","DOI":"10.1109\/BTAS.2016.7791171"},{"key":"1160_CR3","doi-asserted-by":"publisher","unstructured":"Agarwal, A., Singh, R., Vatsa, M., & Noore, A. (2017a). SWAPPED! Digital face presentation attack detection via weighted local magnitude pattern. In 2017 IEEE International Joint Conference on Biometrics (IJCB) (pp. 659\u2013665). https:\/\/doi.org\/10.1109\/BTAS.2017.8272754 .","DOI":"10.1109\/BTAS.2017.8272754"},{"key":"1160_CR4","doi-asserted-by":"crossref","unstructured":"Agarwal, A., Singh, R., Vatsa, M., & Ratha, N. (2018). Are image-agnostic universal adversarial perturbations for face recognition difficult to detect? In IEEE international conference on biometrics: Theory, applications, and systems.","DOI":"10.1109\/BTAS.2018.8698548"},{"key":"1160_CR5","doi-asserted-by":"crossref","unstructured":"Agarwal, A., Yadav, D., Kohli, N., Singh, R., Vatsa, M., & Noore, A. (2017b). Face presentation attack with latex masks in multispectral videos. In IEEE conference on computer vision and pattern recognition workshops (pp. 275\u2013283).","DOI":"10.1109\/CVPRW.2017.40"},{"key":"1160_CR6","doi-asserted-by":"publisher","unstructured":"Akbulut, Y., \u015eeng\u00fcr, A., Budak, \u00dc., & Ekici, S. (2017). Deep learning based face liveness detection in videos. In 2017 international artificial intelligence and data processing symposium (IDAP) (pp. 1\u20134). Malatya. https:\/\/doi.org\/10.1109\/IDAP.2017.8090202 .","DOI":"10.1109\/IDAP.2017.8090202"},{"key":"1160_CR7","unstructured":"Akhtar, N., Liu, J., & Mian, A. (2017). Defense against universal adversarial perturbations. arXiv preprint arXiv:1711.05929 ."},{"key":"1160_CR8","doi-asserted-by":"publisher","first-page":"14410","DOI":"10.1109\/ACCESS.2018.2807385","volume":"6","author":"N Akhtar","year":"2018","unstructured":"Akhtar, N., & Mian, A. (2018). Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6, 14410\u201314430.","journal-title":"IEEE Access"},{"key":"1160_CR9","unstructured":"Alaifari, R., Alberti, G. S., & Gauksson, T. (2018). Adef: An iterative algorithm to construct adversarial deformations. arXiv preprint arXiv:1804.07729 ."},{"key":"1160_CR10","unstructured":"Amos, B., Ludwiczuk, B., Harkes, J., Pillai, P., Elgazzar, K., & Satyanarayanan, M. (2016). OpenFace: Face recognition with deep neural networks. http:\/\/github.com\/cmusatyalab\/openface . Accessed 10 Apr 2016."},{"key":"1160_CR11","unstructured":"Athalye, A., & Sutskever, I. (2018). Synthesizing robust adversarial examples. In International conference on machine learning."},{"key":"1160_CR12","doi-asserted-by":"crossref","unstructured":"Bay, H., Tuytelaars, T., & Van\u00a0Gool, L. (2006). Surf: Speeded up robust features. In European conference on computer vision (pp. 404\u2013417).","DOI":"10.1007\/11744023_32"},{"key":"1160_CR13","doi-asserted-by":"crossref","unstructured":"Beveridge, J., Phillips, P., Bolme, D., Draper, B., Given, G., Lui, Y. M., Teli, M., Zhang, H., Scruggs, W., Bowyer, K., Flynn, P., & Cheng, S. (2013). The challenge of face recognition from digital point-and-shoot cameras. In IEEE conference on biometrics: Theory, applications and systems","DOI":"10.1109\/BTAS.2013.6712704"},{"key":"1160_CR14","unstructured":"Bhagoji, A. N., Cullina, D., & Mittal, P. (2017). Dimensionality reduction as a defense against evasion attacks on machine learning classifiers. arXiv preprint arXiv:1704.02654 ."},{"issue":"9","key":"1160_CR15","doi-asserted-by":"publisher","first-page":"1903","DOI":"10.1109\/TIFS.2016.2561898","volume":"11","author":"A Bharati","year":"2016","unstructured":"Bharati, A., Singh, R., Vatsa, M., & Bowyer, K. W. (2016). Detecting facial retouching using supervised deep learning. IEEE Transactions on Information Forensics and Security, 11(9), 1903\u20131913.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"issue":"3","key":"1160_CR16","doi-asserted-by":"publisher","first-page":"561","DOI":"10.1109\/TPAMI.2016.2558154","volume":"39","author":"B Biggio","year":"2017","unstructured":"Biggio, B., Fumera, G., Marcialis, G. L., & Roli, F. (2017). Statistical meta-analysis of presentation attacks for secure multibiometric systems. IEEE Transactions on Pattern Analysis and Machine Intelligence, 39(3), 561\u2013575.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"8","key":"1160_CR17","doi-asserted-by":"publisher","first-page":"1818","DOI":"10.1109\/TIFS.2016.2555286","volume":"11","author":"Z Boulkenafet","year":"2016","unstructured":"Boulkenafet, Z., Komulainen, J., & Hadid, A. (2016). Face spoofing detection using colour texture analysis. IEEE Transactions on Information Forensics and Security, 11(8), 1818\u20131830.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"issue":"2","key":"1160_CR18","first-page":"141","volume":"24","author":"Z Boulkenafet","year":"2017","unstructured":"Boulkenafet, Z., Komulainen, J., & Hadid, A. (2017). Face antispoofing using speeded-up robust features and fisher vector encoding. IEEE Signal Processing Letters, 24(2), 141\u2013145.","journal-title":"IEEE Signal Processing Letters"},{"key":"1160_CR19","first-page":"343","volume":"29","author":"K Bousmalis","year":"2016","unstructured":"Bousmalis, K., Trigeorgis, G., Silberman, N., Krishnan, D., & Erhan, D. (2016). Domain separation networks. Advances in Neural Information Processing Systems, 29, 343\u2013351.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"1160_CR20","doi-asserted-by":"crossref","unstructured":"Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In IEEE symposium on security and privacy (pp. 39\u201357).","DOI":"10.1109\/SP.2017.49"},{"issue":"1","key":"1160_CR21","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1109\/LSP.2014.2347419","volume":"22","author":"J Chen","year":"2015","unstructured":"Chen, J., Deng, Y., Bai, G., & Su, G. (2015). Face image quality assessment based on learning to rank. IEEE Signal Processing Letters, 22(1), 90\u201394.","journal-title":"IEEE Signal Processing Letters"},{"key":"1160_CR22","doi-asserted-by":"crossref","unstructured":"Chen, P. Y., Sharma, Y., Zhang, H., Yi, J., & Hsieh, C. J. (2018). EAD: elastic-net attacks to deep neural networks via adversarial examples. In Thirty-second AAAI conference on artificial intelligence.","DOI":"10.1609\/aaai.v32i1.11302"},{"key":"1160_CR23","doi-asserted-by":"crossref","unstructured":"Chhabra, S., Singh, R., Vatsa, M., & Gupta, G. (2018). Anonymizing k-facial attributes via adversarial perturbations. In International joint conferences on artificial intelligence (pp. 656\u2013662).","DOI":"10.24963\/ijcai.2018\/91"},{"key":"1160_CR24","doi-asserted-by":"publisher","unstructured":"Chingovska, I., Erdogmus, N., Anjos, A., & Marcel, S. (2016). Face recognition systems under spoofing attacks. In T. Bourlai (Ed.), Face recognition across the imaging spectrum. Cham: Springer. https:\/\/doi.org\/10.1007\/978-3-319-28501-6_8 .","DOI":"10.1007\/978-3-319-28501-6_8"},{"key":"1160_CR25","unstructured":"Cisse, M. M., Adi, Y., Neverova, N., & Keshet, J. (2017). Houdini: Fooling deep structured visual and speech recognition models with adversarial examples. In Advances in neural information processing systems (pp. 6977\u20136987)."},{"key":"1160_CR26","unstructured":"Das, N., Shanbhogue, M., Chen, S. T., Hohman, F., Chen, L., Kounavis, M. E., & Chau, D. H. (2017). Keeping the bad guys out: Protecting and vaccinating deep learning with jpeg compression. arXiv preprint arXiv:1705.02900 ."},{"issue":"12","key":"1160_CR27","doi-asserted-by":"publisher","first-page":"1397","DOI":"10.1109\/TCSII.2017.2764460","volume":"64","author":"GB Souza de","year":"2017","unstructured":"de Souza, G. B., da Silva Santos, D. F., Pires, R. G., Marana, A. N., & Papa, J. P. (2017). Deep texture features for robust face spoofing detection. IEEE Transactions on Circuits and Systems II: Express Briefs, 64(12), 1397\u20131401.","journal-title":"IEEE Transactions on Circuits and Systems II: Express Briefs"},{"key":"1160_CR28","doi-asserted-by":"crossref","unstructured":"Deng, J., Dong, W., Socher, R., Li, L., Li, K., & Li, F.-F. (2009). ImageNet: A large-scale hierarchical image database. In IEEE conference on computer vision and pattern recognition (pp. 248\u2013255).","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"1160_CR29","unstructured":"Dziugaite, G. K., Ghahramani, Z., & Roy, D. M. (2016). A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv:1608.00853 ."},{"key":"1160_CR30","unstructured":"Feinman, R., Curtin, R. R., Shintre, S., & Gardner, A. B. (2017). Detecting adversarial samples from artifacts. arXiv preprint arXiv:1703.00410 ."},{"key":"1160_CR31","doi-asserted-by":"crossref","unstructured":"Gan, J., Li, S., Zhai, Y., & Liu, C. (2017). 3d convolutional neural network based on face anti-spoofing. In 2017 2nd international conference on multimedia and image processing (ICMIP) (pp. 1\u20135).","DOI":"10.1109\/ICMIP.2017.9"},{"key":"1160_CR32","doi-asserted-by":"crossref","unstructured":"Goel, A., Singh, A., Agarwal, A., Vatsa, M., & Singh, R. (2018). Smartbox: Benchmarking adversarial detection and mitigation algorithms for face recognition. In IEEE International conference on biometrics: Theory, applications, and systems","DOI":"10.1109\/BTAS.2018.8698567"},{"key":"1160_CR33","unstructured":"Gong, Z., Wang, W., & Ku, W. S. (2017). Adversarial and clean data are not twins. arXiv preprint arXiv:1704.04960 ."},{"key":"1160_CR34","unstructured":"Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International conference on learning representations."},{"key":"1160_CR35","doi-asserted-by":"crossref","unstructured":"Goswami, G., Ratha, N., Agarwal, A., Singh, R., & Vatsa, M. (2018). Unravelling robustness of deep learning based face recognition against adversarial attacks. In Association for the advancement of artificial intelligence.","DOI":"10.1609\/aaai.v32i1.12341"},{"issue":"5","key":"1160_CR36","doi-asserted-by":"publisher","first-page":"807","DOI":"10.1016\/j.imavis.2009.08.002","volume":"28","author":"R Gross","year":"2010","unstructured":"Gross, R., Matthews, I., Cohn, J., Kanade, T., & Baker, S. (2010). Multi-PIE. Image and Vision Computing, 28(5), 807\u2013813.","journal-title":"Image and Vision Computing"},{"key":"1160_CR37","unstructured":"Grosse, K., Manoharan, P., Papernot, N., Backes, M., & McDaniel, P. (2017). On the (statistical) detection of adversarial examples. arXiv preprint arXiv:1702.06280 ."},{"key":"1160_CR38","unstructured":"Gu, S., & Rigazio, L. (2014). Towards deep neural network architectures robust to adversarial examples. arXiv preprint arXiv:1412.5068 ."},{"key":"1160_CR39","unstructured":"Guo, C., Rana, M., Ciss\u00e9, M., & van\u00a0der Maaten, L. (2018). Countering adversarial images using input transformations. In International conference on learning representations."},{"key":"1160_CR40","first-page":"9","volume":"1050","author":"G Hinton","year":"2015","unstructured":"Hinton, G., Vinyals, O., & Dean, J. (2015). Distilling the knowledge in a neural network. Stat, 1050, 9.","journal-title":"Stat"},{"key":"1160_CR41","unstructured":"Huang, G. B., Ramesh, M., Berg, T., & Learned-Miller, E. (2007). Labeled faces in the wild: A database for studying face recognition in unconstrained environments. Tech. Rep. 07\u201349, University of Massachusetts, Amherst."},{"key":"1160_CR42","first-page":"1755","volume":"10","author":"DE King","year":"2009","unstructured":"King, D. E. (2009). Dlib-ml: A machine learning toolkit. Journal of Machine Learning Research, 10, 1755\u20131758.","journal-title":"Journal of Machine Learning Research"},{"key":"1160_CR43","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S. (2016). Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533 ."},{"issue":"2","key":"1160_CR44","doi-asserted-by":"publisher","first-page":"115","DOI":"10.1007\/s10994-010-5207-6","volume":"81","author":"P Laskov","year":"2010","unstructured":"Laskov, P., & Lippmann, R. (2010). Machine learning in adversarial environments. Machine Learning, 81(2), 115\u2013119.","journal-title":"Machine Learning"},{"key":"1160_CR45","unstructured":"Lee, H., Han, S., & Lee, J. (2017). Generative adversarial trainer: Defense to adversarial perturbations with gan. arXiv preprint arXiv:1705.03387 ."},{"key":"1160_CR46","doi-asserted-by":"crossref","unstructured":"Li, X., & Li, F. (2017). Adversarial examples detection in deep networks with convolutional filter statistics. In International conference on computer vision.","DOI":"10.1109\/ICCV.2017.615"},{"key":"1160_CR47","unstructured":"Liang, B., Li, H., Su, M., Li, X., Shi, W., & Wang, X. (2017). Detecting adversarial examples in deep networks with adaptive noise reduction. URL arXiv:1705.08378"},{"key":"1160_CR48","unstructured":"Liu, J., Deng, Y., Bai, T., & Huang, C. (2015). Targeting ultimate accuracy: Face recognition via deep embedding. URL arXiv:1506.07310 ."},{"issue":"8","key":"1160_CR49","first-page":"856","volume":"29","author":"L Liu","year":"2014","unstructured":"Liu, L., Liu, B., Huang, H., & Bovik, A. C. (2014). No-reference image quality assessment based on spatial and spectral entropies. Signal Processing: Image Communication, 29(8), 856\u2013863.","journal-title":"Signal Processing: Image Communication"},{"key":"1160_CR50","first-page":"469","volume":"29","author":"MY Liu","year":"2016","unstructured":"Liu, M. Y., & Tuzel, O. (2016). Coupled generative adversarial networks. Advances in Neural Information Processing Systems, 29, 469\u2013477.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"1160_CR51","doi-asserted-by":"crossref","unstructured":"Lu, J., Issaranon, T., & Forsyth, D. (2017). Safetynet: Detecting and rejecting adversarial examples robustly. In IEEE international conference on computer vision (pp. 446\u2013454).","DOI":"10.1109\/ICCV.2017.56"},{"key":"1160_CR52","unstructured":"Luo, Y., Boix, X., Roig, G., Poggio, T., & Zhao, Q. (2015). Foveation-based mechanisms alleviate adversarial examples. arXiv preprint arXiv:1511.06292 ."},{"issue":"6","key":"1160_CR53","doi-asserted-by":"publisher","first-page":"1273","DOI":"10.1109\/TPAMI.2016.2569436","volume":"39","author":"A Majumdar","year":"2017","unstructured":"Majumdar, A., Singh, R., & Vatsa, M. (2017). Face verification via class sparsity based supervised encoding. IEEE Transactions on Pattern Analysis and Machine Intelligence, 39(6), 1273\u20131280.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"7","key":"1160_CR54","doi-asserted-by":"publisher","first-page":"1713","DOI":"10.1109\/TIFS.2017.2676720","volume":"12","author":"I Manjani","year":"2017","unstructured":"Manjani, I., Tariyal, S., Vatsa, M., Singh, R., & Majumdar, A. (2017). Detecting silicone mask-based presentation attack via deep dictionary learning. IEEE Transactions on Information Forensics and Security, 12(7), 1713\u20131723.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"1160_CR55","doi-asserted-by":"crossref","unstructured":"Meng, D., & Chen, H. (2017). Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security (pp. 135\u2013147).","DOI":"10.1145\/3133956.3134057"},{"key":"1160_CR56","unstructured":"Metzen, J. H., Genewein, T., Fischer, V., & Bischoff, B. (2017). On detecting adversarial perturbations. In International conference on learning representations."},{"key":"1160_CR57","unstructured":"Miyato, T., Dai, A. M., & Goodfellow, I. (2017). Adversarial training methods for semi-supervised text classification. In International conference on learning representations."},{"issue":"5","key":"1160_CR58","doi-asserted-by":"publisher","first-page":"513","DOI":"10.1109\/LSP.2010.2043888","volume":"17","author":"AK Moorthy","year":"2010","unstructured":"Moorthy, A. K., & Bovik, A. C. (2010). A two-step framework for constructing blind image quality indices. IEEE Signal Processing Letters, 17(5), 513\u2013516.","journal-title":"IEEE Signal Processing Letters"},{"key":"1160_CR59","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., & Frossard, P. (2017). Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 1765\u20131773).","DOI":"10.1109\/CVPR.2017.17"},{"key":"1160_CR60","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli, S. M., Fawzi, A., & Frossard, P. (2016). Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 2574\u20132582).","DOI":"10.1109\/CVPR.2016.282"},{"key":"1160_CR61","unstructured":"Multiple encounters dataset (MEDS). (2011). Retrieved October 6, 2017 from http:\/\/www.nist.gov\/itl\/iad\/ig\/sd32.cfm ."},{"key":"1160_CR62","unstructured":"Nayebi, A., & Ganguli, S. (2017). Biologically inspired protection of deep networks from adversarial attacks. arXiv preprint arXiv:1703.09202 ."},{"key":"1160_CR63","doi-asserted-by":"crossref","unstructured":"Nguyen, A., Yosinski, J., & Clune, J. (2015). Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In IEEE conference on computer vision and pattern recognition (pp. 427\u2013436).","DOI":"10.1109\/CVPR.2015.7298640"},{"key":"1160_CR64","unstructured":"NIST face recognition vendor test ongoing. (2018). Retrieved December 10, 2017 from https:\/\/www.nist.gov\/programs-projects\/face-recognition-vendor-test-frvt-ongoing ."},{"key":"1160_CR65","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017). Practical black-box attacks against machine learning. In Proceedings of the ACM on Asia conference on computer and communications security (pp. 506\u2013519). ACM.","DOI":"10.1145\/3052973.3053009"},{"key":"1160_CR66","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z. B., & Swami, A. (2016a). The limitations of deep learning in adversarial settings. In IEEE European symposium on security and privacy (pp. 372\u2013387).","DOI":"10.1109\/EuroSP.2016.36"},{"key":"1160_CR67","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., Wu, X., Jha, S., & Swami, A. (2016b). Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (pp. 582\u2013597).","DOI":"10.1109\/SP.2016.41"},{"key":"1160_CR68","doi-asserted-by":"crossref","unstructured":"Parkhi, O. M., Vedaldi, A., & Zisserman, A. (2015). Deep face recognition. In British machine vision conference (vol.\u00a01, p.\u00a06).","DOI":"10.5244\/C.29.41"},{"key":"1160_CR69","unstructured":"Patel, K., Han, H., Jain, A. K., & Ott, G. (2015). Live face video vs. spoof face video: Use of moire patterns to detect replay video attacks. In 2015 international conference on biometrics (pp. 98\u2013105)."},{"key":"1160_CR70","doi-asserted-by":"crossref","unstructured":"Phillips, P. J., Flynn, P. J., Beveridge, J. R., Scruggs, W., O\u2019Toole, A. J., Bolme, D., Bowyer, K. W., Draper, B. A., Givens G. H., Lui, Y. M., Sahibzada, H., Scallan, J. A., & Weimer, S. (2009). Overview of the multiple biometrics grand challenge. In Advances in biometrics, (pp. 705\u2013714).","DOI":"10.1007\/978-3-642-01793-3_72"},{"key":"1160_CR71","doi-asserted-by":"crossref","unstructured":"Prakash, A., Moran, N., Garber, S., DiLillo, A., & Storer, J. (2018). Deflecting adversarial attacks with pixel deflection. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 8571\u20138580).","DOI":"10.1109\/CVPR.2018.00894"},{"key":"1160_CR72","unstructured":"Radford, A., Metz, L., & Chintala, S. (2015). Unsupervised representation learning with deep convolutional generative adversarial networks. arXiv preprint arXiv:1511.06434 ."},{"key":"1160_CR73","doi-asserted-by":"crossref","unstructured":"Raghavendra, R., Venkatesh, S., Raja, K., Cheikh, F., & Busch, C. (2017). On the vulnerability of extended multispectral face recognition systems towards presentation attacks. In IEEE international conference on identity, security and behavior analysis.","DOI":"10.1109\/ISBA.2017.7947698"},{"key":"1160_CR74","unstructured":"Rakin, A. S., Yi, J., Gong, B., & Fan, D. (2018). Defend deep neural networks against adversarial examples via fixed anddynamic quantized activation functions. arXiv preprint arXiv:1807.06714 ."},{"key":"1160_CR75","unstructured":"Ramachandra, R., & Busch, C. (2017). Presentation attack detection methods for face recognition systems: A comprehensive survey. ACM Computing Survey, 50(1), 8:1\u20138:37."},{"key":"1160_CR76","unstructured":"Ranjan, R., Sankaranarayanan, S., Castillo, C. D., & Chellappa, R. (2017). Improving network robustness against adversarial attacks with compact convolution. arXiv preprint arXiv:1712.00699 ."},{"key":"1160_CR77","unstructured":"Ratha, N. K., Connell, J. H., & Bolle, R. M. (2001). An analysis of minutiae matching strength. In Audio- and video-based biometric person authentication: Third international conference, proceedings (pp. 223\u2013228)."},{"key":"1160_CR78","unstructured":"Rauber, J., Brendel, W., & Bethge, M. (2017). Foolbox v0.8.0: A python toolbox to benchmark the robustness of machine learning models. URL arXiv:1707.04131 ."},{"key":"1160_CR79","doi-asserted-by":"crossref","unstructured":"Ross, A. S., & Doshi-Velez, F. (2018). Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Thirty-second AAAI conference on artificial intelligence.","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"1160_CR80","doi-asserted-by":"publisher","unstructured":"Rozsa, A., G\u00fcnther, M., & Boult, T. E. (2017a). LOTS about attacking deep features. In 2017 IEEE International Joint Conference on Biometrics (IJCB) (pp. 168\u2013176). Denver, CO. https:\/\/doi.org\/10.1109\/BTAS.2017.8272695 .","DOI":"10.1109\/BTAS.2017.8272695"},{"key":"1160_CR81","unstructured":"Rozsa, A., G\u00fcnther, M., Rudd, E. M., & Boult, T. E. (2016). Are facial attributes adversarially robust? In International conference on pattern recognition (pp. 3121\u20133127)."},{"key":"1160_CR82","doi-asserted-by":"publisher","unstructured":"Rozsa, A., G\u00fcnther, M., Rudd, E. M., & Boult, T. E. (2017b). Facial attributes: Accuracy and adversarial robustness. Pattern Recognition Letters. https:\/\/doi.org\/10.1016\/j.patrec.2017.10.024 .","DOI":"10.1016\/j.patrec.2017.10.024"},{"key":"1160_CR83","doi-asserted-by":"crossref","unstructured":"Rudd, E. M., Gunther, M., & Boult, T. E. (2016). Paraph: Presentation attack rejection by analyzing polarization hypotheses. In The IEEE conference on computer vision and pattern recognition workshops.","DOI":"10.1109\/CVPRW.2016.28"},{"key":"1160_CR84","unstructured":"Sabour, S., Cao, Y., Faghri, F., & Fleet, D. J. (2016). Adversarial manipulation of deep representations. In International conference on learning representations."},{"key":"1160_CR85","unstructured":"Samangouei, P., Kabkab, M., & Chellappa, R. (2018). Defense-gan: Protecting classifiers against adversarial attacks using generative models. In International conference on learning representations."},{"key":"1160_CR86","doi-asserted-by":"crossref","unstructured":"Schroff, F., Kalenichenko, D., & Philbin, J. (2015). Facenet: A unified embedding for face recognition and clustering. In IEEE conference on computer vision and pattern recognition (pp. 815\u2013823).","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"1160_CR87","doi-asserted-by":"crossref","unstructured":"Sharif, M., Bhagavatula, S., Bauer, L., & Reiter, M. K. (2016). Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. In ACM SIGSAC conference on computer and communications security (pp. 1528\u20131540).","DOI":"10.1145\/2976749.2978392"},{"key":"1160_CR88","doi-asserted-by":"crossref","unstructured":"Siddiqui, T. A., Bharadwaj, S., Dhamecha, T. I., Agarwal, A., Vatsa, M., Singh, R., & Ratha, N. (2016). Face anti-spoofing with multifeature videolet aggregation. In IEEE international conference on pattern recognition (pp. 1035\u20131040).","DOI":"10.1109\/ICPR.2016.7899772"},{"key":"1160_CR89","doi-asserted-by":"publisher","unstructured":"Singh, M., Singh, R., Vatsa, M., Ratha, N., & Chellappa, R. (2019). Recognizing disguised faces in the wild. IEEE Transactions on Biometrics, Behavior, and Identity Science. https:\/\/doi.org\/10.1109\/TBIOM.2019.2903860 .","DOI":"10.1109\/TBIOM.2019.2903860"},{"issue":"4","key":"1160_CR90","doi-asserted-by":"publisher","first-page":"736","DOI":"10.1109\/TIFS.2015.2398819","volume":"10","author":"DF Smith","year":"2015","unstructured":"Smith, D. F., Wiliem, A., & Lovell, B. C. (2015). Face recognition on consumer devices: Reflections on replay attacks. IEEE Transactions on Information Forensics and Security, 10(4), 736\u2013745.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"1160_CR91","unstructured":"Song, Y., Kim, T., Nowozin, S., Ermon, S., & Kushman, N. (2018). Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In International conference on learning representations."},{"key":"1160_CR92","doi-asserted-by":"crossref","unstructured":"Sun, Y., Wang, X., & Tang, X. (2015). Deeply learned face representations are sparse, selective, and robust. In The IEEE conference on computer vision and pattern recognition.","DOI":"10.1109\/CVPR.2015.7298907"},{"issue":"3","key":"1160_CR93","doi-asserted-by":"publisher","first-page":"293","DOI":"10.1023\/A:1018628609742","volume":"9","author":"JA Suykens","year":"1999","unstructured":"Suykens, J. A., & Vandewalle, J. (1999). Least squares support vector machine classifiers. Neural Processing Letters, 9(3), 293\u2013300.","journal-title":"Neural Processing Letters"},{"key":"1160_CR94","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2014). Intriguing properties of neural networks. In International conference on learning representations. URL arXiv:1312.6199 ."},{"key":"1160_CR95","doi-asserted-by":"crossref","unstructured":"Taigman, Y., Yang, M., Ranzato, M., & Wolf, L. (2014). DeepFace: Closing the Gap to Human-Level Performance in Face Verification. In IEEE conference on computer vision and pattern recognition (pp. 1701 \u2013 1708).","DOI":"10.1109\/CVPR.2014.220"},{"key":"1160_CR96","unstructured":"Tram\u00e8r, F., Kurakin, A., Papernot, N., Goodfellow, I., Boneh, D., & McDaniel, P. (2018). Ensemble adversarial training: Attacks and defenses. In International conference on learning representations."},{"issue":"2","key":"1160_CR97","doi-asserted-by":"publisher","first-page":"137","DOI":"10.1023\/B:VISI.0000013087.49260.fb","volume":"57","author":"P Viola","year":"2004","unstructured":"Viola, P., & Jones, M. J. (2004). Robust real-time face detection. International Journal of Computer Vision, 57(2), 137\u2013154.","journal-title":"International Journal of Computer Vision"},{"issue":"11","key":"1160_CR98","doi-asserted-by":"publisher","first-page":"2884","DOI":"10.1109\/TIFS.2018.2833032","volume":"13","author":"X Wu","year":"2018","unstructured":"Wu, X., He, R., Sun, Z., & Tan, T. (2018). A light cnn for deep face representation with noisy labels. IEEE Transactions on Information Forensics and Security, 13(11), 2884\u20132896.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"1160_CR99","unstructured":"Xie, C., Wang, J., Zhang, Z., Ren, Z., & Yuille, A. (2018). Mitigating adversarial effects through randomization. In International conference on learning representations."},{"key":"1160_CR100","doi-asserted-by":"crossref","unstructured":"Xie, C., Wang, J., Zhang, Z., Zhou, Y., Xie, L., & Yuille, A. (2017). Adversarial examples for semantic segmentation and object detection. In IEEE international conference on computer vision.","DOI":"10.1109\/ICCV.2017.153"},{"key":"1160_CR101","doi-asserted-by":"crossref","unstructured":"Xu, W., Evans, D., & Qi, Y. (2018). Feature squeezing: Detecting adversarial examples in deep neural networks. In Network and distributed system security symposium.","DOI":"10.14722\/ndss.2018.23198"},{"key":"1160_CR102","unstructured":"Ye, S., Wang, S., Wang, X., Yuan, B., Wen, W., & Lin, X. (2018). Defending DNN adversarial attacks with pruning and logits augmentation. In International conference on learning representations workshop."}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-019-01160-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s11263-019-01160-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-019-01160-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,14]],"date-time":"2022-09-14T05:40:34Z","timestamp":1663134034000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s11263-019-01160-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,3,22]]},"references-count":102,"journal-issue":{"issue":"6-7","published-print":{"date-parts":[[2019,6]]}},"alternative-id":["1160"],"URL":"https:\/\/doi.org\/10.1007\/s11263-019-01160-w","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,3,22]]},"assertion":[{"value":"22 February 2018","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 January 2019","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 March 2019","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}