{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T22:28:53Z","timestamp":1769552933413,"version":"3.49.0"},"reference-count":43,"publisher":"Springer Science and Business Media LLC","issue":"12","license":[{"start":{"date-parts":[[2024,6,19]],"date-time":"2024-06-19T00:00:00Z","timestamp":1718755200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,6,19]],"date-time":"2024-06-19T00:00:00Z","timestamp":1718755200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["no.61876155"],"award-info":[{"award-number":["no.61876155"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Jiangsu Science and Technology Programme","award":["no. BE2020006-4"],"award-info":[{"award-number":["no. BE2020006-4"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2024,12]]},"DOI":"10.1007\/s11263-024-02111-w","type":"journal-article","created":{"date-parts":[[2024,6,19]],"date-time":"2024-06-19T14:02:17Z","timestamp":1718805737000},"page":"5565-5581","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":3,"title":["Inter-feature Relationship Certifies Robust Generalization of Adversarial Training"],"prefix":"10.1007","volume":"132","author":[{"given":"Shufei","family":"Zhang","sequence":"first","affiliation":[]},{"given":"Zhuang","family":"Qian","sequence":"additional","affiliation":[]},{"given":"Kaizhu","family":"Huang","sequence":"additional","affiliation":[]},{"given":"Qiu-Feng","family":"Wang","sequence":"additional","affiliation":[]},{"given":"Bin","family":"Gu","sequence":"additional","affiliation":[]},{"given":"Huan","family":"Xiong","sequence":"additional","affiliation":[]},{"given":"Xinping","family":"Yi","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,6,19]]},"reference":[{"key":"2111_CR1","first-page":"499","volume":"2","author":"O Bousquet","year":"2002","unstructured":"Bousquet, O., & Elisseeff, A. (2002). Stability and generalization. The Journal of Machine Learning Research, 2, 499\u2013526.","journal-title":"The Journal of Machine Learning Research"},{"key":"2111_CR2","doi-asserted-by":"crossref","unstructured":"Carlini, N. & Wagner, D. (2017). Towards evaluating the robustness of neural networks. In 2017 IEEE symposium on security and privacy (sp), pp. 39\u201357.","DOI":"10.1109\/SP.2017.49"},{"key":"2111_CR3","doi-asserted-by":"crossref","unstructured":"Carlini, N. & Wagner, D. (2018). Audio adversarial examples: Targeted attacks on speech-to-text. (2018) IEEE security and privacy workshops (spw) (1\u20137).","DOI":"10.1109\/SPW.2018.00009"},{"key":"2111_CR4","unstructured":"Chen, Y., Ren, Q. & Yan, J. (2022). Rethinking and improving robustness of convolutional neural networks: A shapley value-based approach in frequency domain. Advances in neural information processing systems."},{"key":"2111_CR5","unstructured":"Croce, F. & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. ICML."},{"key":"2111_CR6","unstructured":"Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Tramer, F. & Song, D. (2018). Physical adversarial examples for object detectors. arxiv preprint arxiv:1807.07769."},{"key":"2111_CR7","unstructured":"Fischer, V., Kumar, M. C., Metzen, J. H. & Brox, T. (2017). Adversarial examples for semantic image segmentation. arxiv preprint arxiv:1703.01101."},{"key":"2111_CR8","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S. & Sun, J. (2016). Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770\u2013778.","DOI":"10.1109\/CVPR.2016.90"},{"key":"2111_CR9","unstructured":"Kannan, H., Kurakin, A. & Goodfellow, I. (2018). Adversarial logit pairing. arxiv:1803.06373."},{"key":"2111_CR10","unstructured":"Kawaguchi, K., Deng, Z., Luh, K. & Huang, J. (2022). Robustness implies generalization via data-dependent generalization bounds. In International conference on machine learning, 10866\u201310894."},{"key":"2111_CR11","unstructured":"Krizhevsky, A., Nair, V. & Hinton, G. (2014). The cifar-10 dataset. https:\/\/www.cs.toronto.edu\/~kriz\/cifar.html"},{"key":"2111_CR12","unstructured":"Lamb, A., Binas, J., Goyal, A., Serdyuk, D., Subramanian, S., Mitliagkas, I. & Bengio, Y. (2018). Fortified networks: Improving the robustness of deep networks by modeling the manifold of hidden representations. arxiv:1804.02485."},{"key":"2111_CR13","doi-asserted-by":"crossref","unstructured":"LeCun, Y., Bengio, Y. & Hinton, G. (2015). Deep learning. Nature (521, 436). Nature Publishing Group.","DOI":"10.1038\/nature14539"},{"key":"2111_CR14","doi-asserted-by":"crossref","unstructured":"Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X. & Zhu, J. (2018). Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1778\u20131787.","DOI":"10.1109\/CVPR.2018.00191"},{"key":"2111_CR15","doi-asserted-by":"crossref","unstructured":"Lyu, C., Huang, K. & Liang, H.-N. (2015). A unified gradient regularization family for adversarial examples. In 2015 IEEE international conference on data mining, pp. 301\u2013309.","DOI":"10.1109\/ICDM.2015.84"},{"key":"2111_CR16","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D. & Vladu, A. (2017). Towards deep learning models resistant to adversarial attacks. arxiv:1706.06083."},{"key":"2111_CR17","unstructured":"Mao, C., Zhong, Z., Yang, J., Vondrick, C. & Ray, B. (2019). Metric learning for adversarial robustness. In Advances in neural information processing systems, pp. 478\u2013489."},{"key":"2111_CR18","unstructured":"Miyato, T., Maeda, S-i., Koyama, M. & Ishii, S. (2017). Virtual adversarial training: a regularization method for supervised and semi-supervised learning. arxiv:1704.03976."},{"key":"2111_CR19","unstructured":"Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B. & Ng, A. Y. (2011). Reading digits in natural images with unsupervised feature learning.."},{"key":"2111_CR20","unstructured":"Neyshabur, B., Bhojanapalli, S., McAllester, D. & Srebro, N. (2017). Exploring generalization in deep learning. arxiv preprint arxiv:1706.08947."},{"key":"2111_CR21","doi-asserted-by":"crossref","unstructured":"Otter, D. W., Medina, J. R., & Kalita, J. K. (2020). A survey of the usages of deep learning for natural language processing. IEEE Transactions on Neural Networks and Learning Systems.","DOI":"10.1109\/TNNLS.2020.2979670"},{"key":"2111_CR22","doi-asserted-by":"crossref","unstructured":"Qian, Z., Huang, K., Wang, Q. & Zhang, X. (2022). A survey of robust adversarial training in pattern recognition: Fundamental, theory, and methodologies. 131, 108889.","DOI":"10.1016\/j.patcog.2022.108889"},{"key":"2111_CR23","unstructured":"Rice, L., Wong, E. & Kolter, J. Z. (2020). Overfitting in adversarially robust deep learning."},{"key":"2111_CR24","unstructured":"Roth, K., Kilcher, Y. & Hofmann, T. (2020). Adversarial training is a form of data-dependent operator norm regularization, (33)."},{"key":"2111_CR25","unstructured":"Schmidt, L., Santurkar, S., Tsipras, D., Talwar, K. & Madry, A. (2018). Adversarially robust generalization requires more data. Advances in neural information processing systems, pp. 5014\u20135026."},{"key":"2111_CR26","unstructured":"Sinha, A., Singh, M., Kumari, N., Krishnamurthy, B., Machiraju, H. & Balasubramanian, V. (2019). Harnessing the vulnerability of latent layers in adversarially trained models. arxiv:1905.05186."},{"key":"2111_CR27","unstructured":"Song, C., He, K., Lin, J., Wang, L. & Hopcroft, J. E. (2019). Robust local features for improving the generalization of adversarial training."},{"key":"2111_CR28","first-page":"9155","volume":"119","author":"D Stutz","year":"2020","unstructured":"Stutz, D., Hein, M., & Schiele, B. (2020). Confidence-calibrated adversarial training: Generalizing to unseen attacks. Proceedings of the International Conference on Machine Learning (ICML), 119, 9155\u20139166.","journal-title":"Proceedings of the International Conference on Machine Learning (ICML)"},{"key":"2111_CR29","doi-asserted-by":"crossref","unstructured":"Wang, J. & Zhang, H. (2019). Bilateral adversarial training: Towards fast training of more robust models against adversarial attacks. In Proceedings of the IEEE international conference on computer vision.","DOI":"10.1109\/ICCV.2019.00673"},{"key":"2111_CR30","unstructured":"Wu, D., Xia, S-T. & Wang, Y. (2020). Adversarial weight perturbation helps robust generalization. Advances in neural information processing systems, 33."},{"key":"2111_CR31","doi-asserted-by":"crossref","unstructured":"Xu, H., & Mannor, S. (2012). Robustness and generalization. Machine learning, 86, 391\u2013423.","DOI":"10.1007\/s10994-011-5268-1"},{"key":"2111_CR32","unstructured":"Yang, Y.-Y., Rashtchian, C., Zhang, H., Salakhutdinov, R. & Chaudhuri, K. (2020). A closer look at accuracy vs. robustness. (33)."},{"key":"2111_CR33","unstructured":"Yin, D., Kannan, R., Bartlett, P. (2019). Rademacher complexity for adversarially robust generalization. International conference on machine learning, 7085\u20137094."},{"key":"2111_CR34","doi-asserted-by":"crossref","unstructured":"You, Z., Ye, J., Li, K., Xu, Z. & Wang, P. (2019). Adversarial noise layer: Regularize neural network by adding noise. In 2019 IEEE international conference on image processing (ICIP), pp. 909\u2013913.","DOI":"10.1109\/ICIP.2019.8803055"},{"key":"2111_CR35","doi-asserted-by":"crossref","unstructured":"Zagoruyko, S. & Komodakis, N. (2016). Wide residual networks. arxiv preprint arxiv:1605.07146","DOI":"10.5244\/C.30.87"},{"key":"2111_CR36","unstructured":"Zhai, R., Cai, T., He, D., Dan, C., He, K., Hopcroft, J. & Wang, L. (2019). Adversarially robust generalization just requires more unlabeled data. arxiv preprint arxiv:1906.00555"},{"key":"2111_CR37","unstructured":"Zhang, B., Jiang, D., He, D. & Wang, L. (2022). Rethinking lipschitz neural networks and certified robustness: A boolean function perspective. Advances in neural information processing systems."},{"key":"2111_CR38","unstructured":"Zhang, H. & Wang, J. (2019). Defense against adversarial attacks using feature scattering-based adversarial training. Advances in neural information processing systems, pp. 1829\u20131839."},{"key":"2111_CR39","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E. P., Ghaoui, L. E. & Jordan, M. I. (2019). Theoretically principled trade-off between robustness and accuracy."},{"key":"2111_CR40","unstructured":"Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M. & Kankanhalli, M. (2020). Attacks which do not kill training make adversarial learning stronger. arxiv preprint arxiv:2002.11242."},{"key":"2111_CR41","unstructured":"Zhang, S., Qian, Z., Huang, K., Wang, Q., Zhang, R. & Yi, X. (2021). Towards better robust generalization with shift consistency regularization. International Conference on Machine Learning, pp. 12524\u201312534."},{"key":"2111_CR42","doi-asserted-by":"publisher","first-page":"3212","DOI":"10.1109\/TNNLS.2018.2876865","volume":"30","author":"Z-Q Zhao","year":"2019","unstructured":"Zhao, Z.-Q., Zheng, P., Xu, S.-t, & Wu, X. (2019). Object detection with deep learning: A review. IEEE Transactions on Neural Networks and Learning Systems, 30, 3212\u20133232. IEEE.","journal-title":"IEEE Transactions on Neural Networks and Learning Systems"},{"key":"2111_CR43","unstructured":"Zimmermann, R. S., Brendel, W., Tramer, F. & Carlini, N. (2022). Increasing confidence in adversarial robustness evaluations. Advances in neural information processing systems."}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-024-02111-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-024-02111-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-024-02111-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,11,15]],"date-time":"2024-11-15T10:09:43Z","timestamp":1731665383000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-024-02111-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,6,19]]},"references-count":43,"journal-issue":{"issue":"12","published-print":{"date-parts":[[2024,12]]}},"alternative-id":["2111"],"URL":"https:\/\/doi.org\/10.1007\/s11263-024-02111-w","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,6,19]]},"assertion":[{"value":"16 December 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 April 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 June 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no conflict of interest to declare that are relevant to the content of this article.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with human participants performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics Approval"}},{"value":"Informed consent was obtained from all individual participants included in the study.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to Participate"}},{"value":"Consent for publication was obtained from the participants.","order":5,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for Publication"}},{"value":"The code for this article will be open-sourced when the preparation is finished.","order":6,"name":"Ethics","group":{"name":"EthicsHeading","label":"Code Availability"}}]}}