{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,21]],"date-time":"2026-05-21T18:47:40Z","timestamp":1779389260324,"version":"3.53.1"},"reference-count":68,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2022,10,10]],"date-time":"2022-10-10T00:00:00Z","timestamp":1665360000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,10,10]],"date-time":"2022-10-10T00:00:00Z","timestamp":1665360000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2023,1]]},"DOI":"10.1007\/s11263-022-01701-w","type":"journal-article","created":{"date-parts":[[2022,10,10]],"date-time":"2022-10-10T14:03:59Z","timestamp":1665410639000},"page":"160-176","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":9,"title":["Minimally Distorted Structured Adversarial Attacks"],"prefix":"10.1007","volume":"131","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4866-7245","authenticated-orcid":false,"given":"Ehsan","family":"Kazemi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thomas","family":"Kerdreux","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Liqiang","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,10,10]]},"reference":[{"key":"1701_CR1","unstructured":"Allen-Zhu, Z., Hazan, E., & Hu, W., et\u00a0al. (2017). Linear convergence of a frank-wolfe type algorithm over trace-norm balls. In Advances in neural information processing systems (pp. 6191\u20136200)."},{"key":"1701_CR2","unstructured":"Athalye, A., Carlini, N., & Wagner, D. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv:1802.00420"},{"issue":"6","key":"1701_CR3","doi-asserted-by":"publisher","first-page":"717","DOI":"10.1007\/s10208-009-9045-5","volume":"9","author":"EJ Cand\u00e8s","year":"2009","unstructured":"Cand\u00e8s, E. J., & Recht, B. (2009). Exact matrix completion via convex optimization. Foundations of Computational mathematics, 9(6), 717.","journal-title":"Foundations of Computational mathematics"},{"key":"1701_CR4","doi-asserted-by":"crossref","unstructured":"Carlini, N., & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (SP) (pp. 39\u201357). IEEE.","DOI":"10.1109\/SP.2017.49"},{"key":"1701_CR5","unstructured":"Carlini, N., Athalye, A., & Papernot, N., et\u00a0al. (2019). On evaluating adversarial robustness. arXiv:1902.06705"},{"key":"1701_CR6","unstructured":"Chen, J., Yi, J., & Gu, Q. (2018). A frank-wolfe framework for efficient and effective adversarial attacks. arXiv:1811.10828"},{"key":"1701_CR7","doi-asserted-by":"crossref","unstructured":"Cheung, E., & Li, Y. (2017). Projection free rank-drop steps. arXiv:1704.04285","DOI":"10.24963\/ijcai.2017\/213"},{"key":"1701_CR8","unstructured":"Cohen, J. M., Rosenfeld, E., & Kolter, J. Z. (2019). Certified adversarial robustness via randomized smoothing. arXiv:1902.02918"},{"key":"1701_CR9","doi-asserted-by":"crossref","unstructured":"Croce, F., & Hein, M. (2019). Sparse and imperceivable adversarial attacks. In Proceedings of the IEEE international conference on computer vision (pp. 4724\u20134732).","DOI":"10.1109\/ICCV.2019.00482"},{"key":"1701_CR10","unstructured":"Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, PMLR (pp. 2206\u20132216)."},{"key":"1701_CR11","doi-asserted-by":"crossref","unstructured":"Cui, J., Liu, S., & Wang, L., et\u00a0al. (2021). Learnable boundary guided adversarial training. In Proceedings of the IEEE\/CVF international conference on computer vision (pp. 15721\u201315730).","DOI":"10.1109\/ICCV48922.2021.01543"},{"key":"1701_CR12","unstructured":"Demyanov, V. F., & Rubinov, A. M. (1970). Approximate methods in optimization problems. In Modern analytic and computational methods in science and mathematics."},{"key":"1701_CR13","unstructured":"Dudik, M., Harchaoui, Z., & Malick, J. (2012). Lifted coordinate descent for learning with trace-norm regularization. In Artificial intelligence and statistics (pp. 327\u2013336)."},{"issue":"2","key":"1701_CR14","doi-asserted-by":"publisher","first-page":"187","DOI":"10.1137\/0317015","volume":"17","author":"JC Dunn","year":"1979","unstructured":"Dunn, J. C. (1979). Rates of convergence for conditional gradient algorithms near singular and nonsingular extremals. SIAM Journal on Control and Optimization, 17(2), 187\u2013211.","journal-title":"SIAM Journal on Control and Optimization"},{"key":"1701_CR15","unstructured":"Engstrom, L., Tran, B., & Tsipras, D., et\u00a0al. (2017). A rotation and a translation suffice: Fooling cnns with simple transformations. arXiv:1712.02779"},{"key":"1701_CR16","doi-asserted-by":"crossref","unstructured":"Fazel, M., Hindi, H., & Boyd, S. P. (2001). A rank minimization heuristic with application to minimum order system approximation. In Proceedings of the 2001 American control conference (Cat. No. 01CH37148) (pp. 4734\u20134739). IEEE.","DOI":"10.1109\/ACC.2001.945730"},{"issue":"1\u20132","key":"1701_CR17","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1002\/nav.3800030109","volume":"3","author":"M Frank","year":"1956","unstructured":"Frank, M., & Wolfe, P. (1956). An algorithm for quadratic programming. Naval Research Logistics Quarterly, 3(1\u20132), 95\u2013110.","journal-title":"Naval Research Logistics Quarterly"},{"issue":"1","key":"1701_CR18","doi-asserted-by":"publisher","first-page":"319","DOI":"10.1137\/15M104726X","volume":"27","author":"RM Freund","year":"2017","unstructured":"Freund, R. M., Grigas, P., & Mazumder, R. (2017). An extended frank-wolfe method with \u201cin-face\u2019\u2019 directions, and its application to low-rank matrix completion. SIAM Journal on Optimization, 27(1), 319\u2013346.","journal-title":"SIAM Journal on Optimization"},{"key":"1701_CR19","unstructured":"Garber, D., & Hazan, E. (2013a). A linearly convergent conditional gradient algorithm with applications to online and stochastic optimization. arXiv:1301.4666"},{"key":"1701_CR20","doi-asserted-by":"crossref","unstructured":"Garber, D., & Hazan, E. (2013b). Playing non-linear games with linear oracles. In 2013 IEEE 54th annual symposium on foundations of computer science (pp. 420\u2013428). IEEE.","DOI":"10.1109\/FOCS.2013.52"},{"key":"1701_CR21","unstructured":"Garber, D., & Hazan, E. (2015). Faster rates for the frank-wolfe method over strongly-convex sets. In 32nd International conference on machine learning, ICML 2015."},{"key":"1701_CR22","unstructured":"Garber, D., Sabach, S., & Kaplan, A. (2018). Fast generalized conditional gradient method with applications to matrix recovery problems. arXiv:1802.05581"},{"key":"1701_CR23","doi-asserted-by":"crossref","unstructured":"Gatys, L. A., Ecker, A. S., & Bethge, M., et\u00a0al. (2017). Controlling perceptual factors in neural style transfer. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 3985\u20133993).","DOI":"10.1109\/CVPR.2017.397"},{"key":"1701_CR24","unstructured":"Gilmer, J., Adams, R.P., & Goodfellow, I., et\u00a0al. (2018). Motivating the rules of the game for adversarial example research. arXiv:1807.06732"},{"key":"1701_CR25","unstructured":"Goodfellow, I. J., Shlens, J., & Szegedy, C. (2015). Explaining and harnessing adversarial examples. In International conference on learning representations."},{"key":"1701_CR26","doi-asserted-by":"publisher","first-page":"142","DOI":"10.1016\/j.patrec.2021.03.033","volume":"147","author":"D Gragnaniello","year":"2021","unstructured":"Gragnaniello, D., Marra, F., Verdoliva, L., et al. (2021). Perceptual quality-preserving black-box attack against deep learning image classifiers. Pattern Recognition Letters, 147, 142\u2013149.","journal-title":"Pattern Recognition Letters"},{"key":"1701_CR27","doi-asserted-by":"crossref","unstructured":"Gu\u00e9lat, J., & Marcotte, P. (1986). Some comments on Wolfe\u2019s \u2018away step\u2019. Mathematical Programming.","DOI":"10.1007\/BF01589445"},{"key":"1701_CR28","unstructured":"Guo, C., Frank, J. S., & Weinberger, K. Q. (2018). Low frequency adversarial perturbation. arXiv:1809.08758"},{"key":"1701_CR29","unstructured":"Guo, Q., Juefei-Xu, F., & Xie, X., et\u00a0al. (2020). Watch out! motion is blurring the vision of your deep neural networks. arXiv:2002.03500"},{"key":"1701_CR30","unstructured":"Hameed, M. Z., & Gyorgy, A. (2021). Perceptually constrained adversarial attacks. arXiv:2102.07140"},{"key":"1701_CR31","doi-asserted-by":"crossref","unstructured":"Harchaoui, Z., Douze, M., & Paulin, M., et\u00a0al. (2012). Large-scale image classification with trace-norm regularization. In 2012 IEEE conference on computer vision and pattern recognition (pp. 3386\u20133393). IEEE.","DOI":"10.1109\/CVPR.2012.6248078"},{"key":"1701_CR32","unstructured":"Jaggi, M. (2013). Revisiting frank-wolfe: Projection-free sparse convex optimization. In Proceedings of the 30th international conference on machine learning, CONF (pp. 427\u2013435)."},{"key":"1701_CR33","unstructured":"Jaggi, M., & Sulovsk\u1ef3, M. (2010). A simple algorithm for nuclear norm regularized problems. In ICML."},{"key":"1701_CR34","unstructured":"Kerdreux, T., & d\u2019Aspremont, A. (2020). Frank-wolfe on uniformly convex sets. arXiv:2004.11053"},{"key":"1701_CR35","unstructured":"Kerdreux, T., Pedregosa, F., & d\u2019Aspremont, A. (2018). Frank-wolfe with subsampling oracle. arXiv:1803.07348"},{"key":"1701_CR36","unstructured":"Keskar, N. S., Mudigere, D., & Nocedal, J., et\u00a0al. (2016). On large-batch training for deep learning: Generalization gap and sharp minima. arXiv:1609.04836"},{"key":"1701_CR37","unstructured":"Kurakin, A., Goodfellow, I., & Bengio, S. (2016). Adversarial examples in the physical world. arXiv:1607.02533"},{"key":"1701_CR38","unstructured":"Lacoste-Julien, S., & Jaggi, M. (2013). An affine invariant linear convergence analysis for frank-wolfe algorithms. arXiv:1312.7864"},{"key":"1701_CR39","unstructured":"Lacoste-Julien, S., & Jaggi, M. (2015). On the global linear convergence of Frank\u2013Wolfe optimization variants. In Cortes, C., Lawrence, N. D., Lee, D. D., et\u00a0al (Eds.). Advances in neural information processing systems (Vol.\u00a028, pp. 496\u2013504). Curran Associates, Inc."},{"key":"1701_CR40","unstructured":"Langeberg, P., Balda, E. R., & Behboodi, A., et\u00a0al. (2019). On the effect of low-rank weights on adversarial robustness of neural networks. arXiv:1901.10371"},{"key":"1701_CR41","unstructured":"Lee, J.D., Recht, B., & Srebro, N., et\u00a0al. (2010). Practical large-scale optimization for max-norm regularization. In Advances in neural information processing systems (pp. 1297\u20131305)."},{"issue":"5","key":"1701_CR42","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/0041-5553(66)90114-5","volume":"6","author":"ES Levitin","year":"1966","unstructured":"Levitin, E. S., & Polyak, B. T. (1966). Constrained minimization methods. USSR Computational Mathematics and Mathematical Physics, 6(5), 1\u201350.","journal-title":"USSR Computational Mathematics and Mathematical Physics"},{"key":"1701_CR43","unstructured":"Liu, H. T. D., Tao, M., & Li, C. L., et\u00a0al. (2018). Beyond pixel norm-balls: Parametric adversaries using an analytically differentiable renderer. In International conference on learning representations."},{"key":"1701_CR44","doi-asserted-by":"crossref","unstructured":"Lu, M., Zhao, H., & Yao, A., et\u00a0al. (2017). Decoder network over lightweight reconstructed feature for fast semantic style transfer. In Proceedings of the IEEE international conference on computer vision (pp. 2469\u20132477).","DOI":"10.1109\/ICCV.2017.270"},{"key":"1701_CR45","doi-asserted-by":"crossref","unstructured":"Luo, B., Liu, Y., & Wei, L., et\u00a0al. (2018). Towards imperceptible and robust adversarial example attacks against neural networks. In Thirty-second AAAI conference on artificial intelligence.","DOI":"10.1609\/aaai.v32i1.11499"},{"key":"1701_CR46","unstructured":"Madry, A., Makelov, A., & Schmidt, L., et\u00a0al. (2017). Towards deep learning models resistant to adversarial attacks. arXiv:1706.06083"},{"key":"1701_CR47","doi-asserted-by":"crossref","unstructured":"Papernot, N., McDaniel, P., & Jha, S., et\u00a0al. (2016). The limitations of deep learning in adversarial settings. In 2016 IEEE European symposium on security and privacy (EuroS &P) (pp. 372\u2013387). IEEE.","DOI":"10.1109\/EuroSP.2016.36"},{"key":"1701_CR48","unstructured":"Raghunathan, A., Steinhardt, J., & Liang, P. (2018). Certified defenses against adversarial examples. arXiv:1801.09344"},{"key":"1701_CR49","unstructured":"Rauber, J., Brendel, W., & Bethge, M. (2017). Foolbox: A python toolbox to benchmark the robustness of machine learning models. In Reliable machine learning in the wild workshop, 34th international conference on machine learning. http:\/\/arxiv.org\/abs\/1707.04131"},{"key":"1701_CR50","unstructured":"Reed, S.E., Akata, Z., & Mohan, S., et\u00a0al. (2016). Learning what and where to draw. In: Advances in neural information processing systems (pp. 217\u2013225)."},{"key":"1701_CR51","unstructured":"Risser, E., Wilmot, P., & Barnes, C. (2017). Stable and controllable neural texture synthesis and style transfer using histogram losses. arXiv:1701.08893"},{"key":"1701_CR52","unstructured":"Schmidt, L., Santurkar, S., & Tsipras, D., et\u00a0al. (2018). Adversarially robust generalization requires more data. In Advances in neural information processing systems (pp. 5014\u20135026)."},{"key":"1701_CR53","unstructured":"Sen, A., Zhu, X., & Marshall, L., et\u00a0al. (2019). Should adversarial attacks use pixel p-norm? arXiv:1906.02439"},{"key":"1701_CR54","unstructured":"Shalev-Shwartz, S., Gonen, A., & Shamir, O. (2011). Large-scale convex minimization with a low-rank constraint. arXiv:1106.1622"},{"key":"1701_CR55","doi-asserted-by":"crossref","unstructured":"Sharif, M., Bauer, L., & Reiter, M. K. (2018). On the suitability of lp-norms for creating and preventing adversarial examples. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops (pp. 1605\u20131613).","DOI":"10.1109\/CVPRW.2018.00211"},{"key":"1701_CR56","doi-asserted-by":"crossref","unstructured":"Stutz, D., Hein, M., & Schiele, B. (2019). Disentangling adversarial robustness and generalization. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 6976\u20136987)","DOI":"10.1109\/CVPR.2019.00714"},{"key":"1701_CR57","unstructured":"Tomioka, R., & Suzuki, T. (2013). Convex tensor decomposition via structured schatten norm regularization. In Advances in neural information processing systems (pp. 1331\u20131339)."},{"issue":"4","key":"1701_CR58","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang, Z., Bovik, A. C., Sheikh, H. R., et al. (2004). Image quality assessment: From error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4), 600\u2013612.","journal-title":"IEEE Transactions on Image Processing"},{"key":"1701_CR59","unstructured":"Wong, E., & Kolter, J. Z. (2017). Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv:1711.00851"},{"key":"1701_CR60","unstructured":"Wong, E., & Kolter, J. Z. (2020). Learning perturbation sets for robust machine learning. arXiv:2007.08450"},{"key":"1701_CR61","unstructured":"Wong, E., Schmidt, F. R., & Kolter, J. Z. (2019). Wasserstein adversarial examples via projected sinkhorn iterations. arXiv:1902.07906"},{"key":"1701_CR62","unstructured":"Wu, D., Xia, S. T., & Wang, Y. (2020). Adversarial weight perturbation helps robust generalization. arXiv:2004.05884"},{"key":"1701_CR63","unstructured":"Xu, K., Liu, S., & Zhao, P., et\u00a0al. (2018). Structured adversarial attack: Towards general implementation and better interpretability. arXiv:1808.01664"},{"key":"1701_CR64","unstructured":"Yan, Z., Guo, Y., & Zhang, C. (2019). Subspace attack: Exploiting promising subspaces for query-efficient black-box attacks. arXiv:1906.04392"},{"key":"1701_CR65","unstructured":"Yang, G., Duan, T., & Hu, E., et\u00a0al. (2020). Randomized smoothing of all shapes and sizes. arXiv:2002.08118"},{"key":"1701_CR66","unstructured":"Yang, Y., Zhang, G., & Katabi, D., et\u00a0al. (2019). Me-net: Towards effective adversarial robustness with matrix estimation. arXiv:1905.11971"},{"key":"1701_CR67","unstructured":"Zhang, H., Chen, H., & Xiao, C., et\u00a0al. (2019). Towards stable and efficient training of verifiably robust neural networks. arXiv:1906.06316"},{"key":"1701_CR68","doi-asserted-by":"crossref","unstructured":"Zhou, B., Khosla, A., & Lapedriza. A., et\u00a0al. (2016). Learning deep features for discriminative localization. In Proceedings of the IEEE conference on computer vision and pattern recognition (pp. 2921\u20132929).","DOI":"10.1109\/CVPR.2016.319"}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-022-01701-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-022-01701-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-022-01701-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,1,6]],"date-time":"2023-01-06T03:25:04Z","timestamp":1672975504000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-022-01701-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,10]]},"references-count":68,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1]]}},"alternative-id":["1701"],"URL":"https:\/\/doi.org\/10.1007\/s11263-022-01701-w","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,10,10]]},"assertion":[{"value":"30 July 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 October 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 October 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}