{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T22:31:01Z","timestamp":1775773861551,"version":"3.50.1"},"reference-count":81,"publisher":"Springer Science and Business Media LLC","issue":"9","license":[{"start":{"date-parts":[[2025,5,14]],"date-time":"2025-05-14T00:00:00Z","timestamp":1747180800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,5,14]],"date-time":"2025-05-14T00:00:00Z","timestamp":1747180800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int J Comput Vis"],"published-print":{"date-parts":[[2025,9]]},"DOI":"10.1007\/s11263-025-02467-7","type":"journal-article","created":{"date-parts":[[2025,5,14]],"date-time":"2025-05-14T14:51:41Z","timestamp":1747234301000},"page":"5920-5937","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Defending Against Adversarial Examples Via Modeling Adversarial Noise"],"prefix":"10.1007","volume":"133","author":[{"given":"Dawei","family":"Zhou","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1435-489X","authenticated-orcid":false,"given":"Nannan","family":"Wang","sequence":"additional","affiliation":[]},{"given":"Bo","family":"Han","sequence":"additional","affiliation":[]},{"given":"Tongliang","family":"Liu","sequence":"additional","affiliation":[]},{"given":"Xinbo","family":"Gao","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,5,14]]},"reference":[{"key":"2467_CR1","unstructured":"Goodfellow, I.J., Shlens, J., & Szegedy, C (2015) Explaining and harnessing adversarial examples. In: International Conference on Learning Representations"},{"key":"2467_CR2","unstructured":"Athalye, A., Engstrom, L., Ilyas, A., & Kwok, K (2018). Synthesizing robust adversarial examples. In: International Conference on Machine Learning, pp. 284\u2013293. PMLR"},{"key":"2467_CR3","doi-asserted-by":"crossref","unstructured":"Cai, J., Wang, B., Wang, X., & Jin, B (2019). Accelerate black-box attack with white-box prior knowledge. In: Intelligence Science and Big Data Engineering. Big Data and Machine Learning: 9th International Conference, IScIDE 2019, Nanjing, China, October 17\u201320, 2019, Proceedings, Part II 9, 394\u2013405. Springer","DOI":"10.1007\/978-3-030-36204-1_33"},{"key":"2467_CR4","first-page":"1633","volume":"33","author":"F Tramer","year":"2020","unstructured":"Tramer, F., Carlini, N., Brendel, W., & Madry, A. (2020). On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33, 1633\u20131645.","journal-title":"Advances in neural information processing systems"},{"issue":"3","key":"2467_CR5","doi-asserted-by":"publisher","first-page":"1100","DOI":"10.1109\/TPAMI.2019.2936378","volume":"43","author":"S Tang","year":"2021","unstructured":"Tang, S., Huang, X., Chen, M., Sun, C., & Yang, J. (2021). Adversarial attack type i: Cheat classifiers by significant changes. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(3), 1100\u20131109. https:\/\/doi.org\/10.1109\/TPAMI.2019.2936378","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"2467_CR6","first-page":"19716","volume":"35","author":"Y Dong","year":"2022","unstructured":"Dong, Y., Zhu, J., & Gao, X.-S. (2022). Isometric 3d adversarial examples in the physical world. Advances in Neural Information Processing Systems, 35, 19716\u201319731.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"2467_CR7","doi-asserted-by":"publisher","first-page":"57","DOI":"10.1016\/j.patrec.2023.03.001","volume":"168","author":"C Ying","year":"2023","unstructured":"Ying, C., Qiaoben, Y., Zhou, X., Su, H., Ding, W., & Ai, J. (2023). Consistent attack: Universal adversarial perturbation on embodied vision navigation. Pattern Recognition Letters, 168, 57\u201363.","journal-title":"Pattern Recognition Letters"},{"key":"2467_CR8","doi-asserted-by":"crossref","unstructured":"Yin, M., Li, S., Song, C., Asif, M.S., Roy-Chowdhury, A.K., & Krishnamurthy, S.V (2022). Adc: Adversarial attacks against object detection that evade context consistency checks. In: Proceedings of the IEEE\/CVF Winter Conference on Applications of Computer Vision, 3278\u20133287","DOI":"10.1109\/WACV51458.2022.00289"},{"key":"2467_CR9","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1016\/j.neucom.2022.10.046","volume":"519","author":"J-X Mi","year":"2023","unstructured":"Mi, J.-X., Wang, X.-D., Zhou, L.-F., & Cheng, K. (2023). Adversarial examples based on object detection tasks: A survey. Neurocomputing, 519, 114\u2013126.","journal-title":"Neurocomputing"},{"issue":"3","key":"2467_CR10","doi-asserted-by":"publisher","first-page":"2711","DOI":"10.1109\/TPAMI.2022.3176760","volume":"45","author":"X Wei","year":"2023","unstructured":"Wei, X., Guo, Y., & Yu, J. (2023). Adversarial sticker: A stealthy attack method in the physical world. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3), 2711\u20132725. https:\/\/doi.org\/10.1109\/TPAMI.2022.3176760","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"2467_CR11","doi-asserted-by":"crossref","unstructured":"Jaiswal, S., Duggirala, K., Dash, A., & Mukherjee, A. (2022). Two-face: Adversarial audit of commercial face recognition systems. In: Proceedings of the International AAAI Conference on Web and Social Media, 16, 381\u2013392","DOI":"10.1609\/icwsm.v16i1.19300"},{"issue":"1","key":"2467_CR12","doi-asserted-by":"publisher","first-page":"748","DOI":"10.1038\/s41467-021-21007-8","volume":"12","author":"S Feng","year":"2021","unstructured":"Feng, S., Yan, X., Sun, H., Feng, Y., & Liu, H. X. (2021). Intelligent driving intelligence test for autonomous vehicles with naturalistic and adversarial environment. Nature communications, 12(1), 748.","journal-title":"Nature communications"},{"issue":"1","key":"2467_CR13","doi-asserted-by":"publisher","first-page":"2193461","DOI":"10.1080\/08839514.2023.2193461","volume":"37","author":"KH Shibly","year":"2023","unstructured":"Shibly, K. H., Hossain, M. D., Inoue, H., Taenaka, Y., & Kadobayashi, Y. (2023). Towards autonomous driving model resistant to adversarial attack. Applied Artificial Intelligence, 37(1), 2193461.","journal-title":"Applied Artificial Intelligence"},{"issue":"6","key":"2467_CR14","doi-asserted-by":"publisher","first-page":"2119","DOI":"10.1109\/TPAMI.2020.3031625","volume":"43","author":"S Bai","year":"2021","unstructured":"Bai, S., Li, Y., Zhou, Y., Li, Q., & Torr, P. H. S. (2021). Adversarial metric attack and defense for person re-identification. IEEE Transactions on Pattern Analysis and Machine Intelligence, 43(6), 2119\u20132126. https:\/\/doi.org\/10.1109\/TPAMI.2020.3031625","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"4","key":"2467_CR15","doi-asserted-by":"publisher","first-page":"5218","DOI":"10.1109\/TPAMI.2022.3199013","volume":"45","author":"F Yang","year":"2023","unstructured":"Yang, F., Weng, J., Zhong, Z., Liu, H., Wang, Z., Luo, Z., Cao, D., Li, S., Satoh, S., & Sebe, N. (2023). Towards robust person re-identification by defending against universal attackers. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(4), 5218\u20135235. https:\/\/doi.org\/10.1109\/TPAMI.2022.3199013","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"1","key":"2467_CR16","doi-asserted-by":"publisher","first-page":"5711","DOI":"10.1038\/s41467-022-33266-0","volume":"13","author":"N Ghaffari Laleh","year":"2022","unstructured":"Ghaffari Laleh, N., Truhn, D., Veldhuizen, G. P., Han, T., Treeck, M., Buelow, R. D., Langer, R., Dislich, B., Boor, P., & Schulz, V. (2022). Adversarial attacks and adversarial robustness in computational pathology. Nature Communications, 13(1), 5711.","journal-title":"Nature Communications"},{"key":"2467_CR17","doi-asserted-by":"crossref","unstructured":"Puttagunta, M.K., Ravi, S., & Nelson Kennedy\u00a0Babu, C (2023). Adversarial examples: attacks and defences on medical deep learning systems. Multimedia Tools and Applications, 1\u201337","DOI":"10.1007\/s11042-023-14702-9"},{"key":"2467_CR18","doi-asserted-by":"crossref","unstructured":"Li, X., Wang, Z., Zhang, B., Sun, F., & Hu, X. (2023). Recognizing object by components with human prior knowledge enhances adversarial robustness of deep neural networks. IEEE Transactions on Pattern Analysis and Machine Intelligence","DOI":"10.1109\/TPAMI.2023.3237935"},{"key":"2467_CR19","doi-asserted-by":"crossref","unstructured":"Wei, Z., Wang, Y., Guo, Y., & Wang, Y. (2023). Cfa: Class-wise calibrated fair adversarial training. In: Conference on Computer Vision and Pattern Recognition","DOI":"10.1109\/CVPR52729.2023.00792"},{"key":"2467_CR20","unstructured":"Yan, H., Zhang, J., Niu, G., Feng, J., Tan, V., & Sugiyama, M. (2021). Cifs: Improving adversarial robustness of cnns via channel-wise importance-based feature selection. In: International Conference on Machine Learning, 11693\u201311703. PMLR"},{"key":"2467_CR21","unstructured":"Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., & Yan, S. (2023). Better diffusion models further improve adversarial training. arXiv preprint arXiv:2302.04638"},{"key":"2467_CR22","unstructured":"Zhu, J., Yao, J., Liu, T., Xu, J., & Han, B. (2023). Combating exacerbated heterogeneity for robust models in federated learning. In: The Eleventh International Conference on Learning Representations"},{"issue":"4","key":"2467_CR23","doi-asserted-by":"publisher","first-page":"4727","DOI":"10.1109\/TPAMI.2022.3193449","volume":"45","author":"D Liu","year":"2023","unstructured":"Liu, D., & Hu, W. (2023). Imperceptible transfer attack and defense on 3d point cloud classification. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(4), 4727\u20134746. https:\/\/doi.org\/10.1109\/TPAMI.2022.3193449","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"2467_CR24","unstructured":"Madry, A., Makelov, A., Schmidt, L., Tsipras, D., & Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. In: 6th International Conference on Learning Representations"},{"key":"2467_CR25","doi-asserted-by":"crossref","unstructured":"Liao, F., Liang, M., Dong, Y., Pang, T., Hu, X., & Zhu, J. (2018). Defense against adversarial attacks using high-level representation guided denoiser. In: Conference on Computer Vision and Pattern Recognition, pp. 1778\u20131787","DOI":"10.1109\/CVPR.2018.00191"},{"key":"2467_CR26","doi-asserted-by":"crossref","unstructured":"Naseer, M., Khan, S., Hayat, M., Khan, F.S., & Porikli, F. (2020). A self-supervised approach for adversarial robustness. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 262\u2013271","DOI":"10.1109\/CVPR42600.2020.00034"},{"key":"2467_CR27","unstructured":"Yoon, J., Hwang, S.J., & Lee, J. (2021). Adversarial purification with score-based generative models. In: International Conference on Machine Learning, 12062\u201312072. PMLR"},{"key":"2467_CR28","unstructured":"Li, Y., Zhang, W., Liu, J., Kou, X., Li, H., & Cui, J. (2021). Enhanced countering adversarial attacks via input denoising and feature restoring. arXiv preprint arXiv:2111.10075"},{"key":"2467_CR29","unstructured":"Xiao, C., Chen, Z., Jin, K., Wang, J., Nie, W., Liu, M., Anandkumar, A., Li, B., & Song, D. (2022). Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.00322"},{"key":"2467_CR30","doi-asserted-by":"crossref","unstructured":"Xu, W., Evans, D., & Qi, Y. (2017). Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","DOI":"10.14722\/ndss.2018.23198"},{"key":"2467_CR31","unstructured":"Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., & Madry, A. (2019). Adversarial examples are not bugs, they are features. arXiv preprint arXiv:1905.02175"},{"key":"2467_CR32","unstructured":"Wei, K.-A.A. (2020). Understanding non-robust features in image classification. PhD thesis, Massachusetts Institute of Technology"},{"key":"2467_CR33","first-page":"17148","volume":"34","author":"J Kim","year":"2021","unstructured":"Kim, J., Lee, B.-K., & Ro, Y. M. (2021). Distilling robust and non-robust features in adversarial examples by information bottleneck. Advances in Neural Information Processing Systems, 34, 17148\u201317159.","journal-title":"Advances in Neural Information Processing Systems"},{"key":"2467_CR34","unstructured":"Zhou, D., Wang, N., Han, B., & Liu, T. (2022) Modeling adversarial noise for adversarial training. In: International Conference on Machine Learning, 27353\u201327366. PMLR"},{"key":"2467_CR35","unstructured":"Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I.J., & Fergus, R. (2014). Intriguing properties of neural networks. In: International Conference on Learning Representations"},{"key":"2467_CR36","doi-asserted-by":"crossref","unstructured":"Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., & Li, J. (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"2467_CR37","doi-asserted-by":"crossref","unstructured":"Wang, X., & He, K. (2021). Enhancing the transferability of adversarial attacks through variance tuning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 1924\u20131933","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"2467_CR38","doi-asserted-by":"crossref","unstructured":"Carlini, N., & Wagner, D (2017) Towards evaluating the robustness of neural networks. In: 2017 Ieee Symposium on Security and Privacy (sp), 39\u201357. IEEE","DOI":"10.1109\/SP.2017.49"},{"key":"2467_CR39","doi-asserted-by":"crossref","unstructured":"Rony, J., Hafemann, L.G., Oliveira, L.S., Ayed, I.B., Sabourin, R., & Granger, E. (2019). Decoupling direction and norm for efficient gradient-based L2 adversarial attacks and defenses. In: Conference on Computer Vision and Pattern Recognition, pp. 4322\u20134330","DOI":"10.1109\/CVPR.2019.00445"},{"key":"2467_CR40","unstructured":"Croce, F., & Hein, M. (2020) Minimally distorted adversarial examples with a fast adaptive boundary attack. In: International Conference on Machine Learning, 2196\u20132205. PMLR"},{"key":"2467_CR41","unstructured":"Croce, F., & Hein, M. (2020). Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In: International Conference on Machine Learning, pp. 2206\u20132216. PMLR"},{"key":"2467_CR42","unstructured":"Ding, G.W., Lui, K.Y.C., Jin, X., Wang, L., & Huang, R. (2019). On the sensitivity of adversarial robustness to input data distributions. In: ICLR (Poster)"},{"key":"2467_CR43","unstructured":"Yu, C., Zhou, D., Shen, L., Yu, J., Han, B., Gong, M., Wang, N., & Liu, T. (2022). Strength-adaptive adversarial training. arXiv preprint arXiv:2210.01288"},{"key":"2467_CR44","unstructured":"Zhou, J., Zhu, J., Zhang, J., Liu, T., Niu, G., Han, B., & Sugiyama, M. (2022). Adversarial training with complementary labels: On the benefit of gradually informative attacks. In: Advances in Neural Information Processing Systems"},{"key":"2467_CR45","doi-asserted-by":"crossref","unstructured":"Yu, C., Han, B., Gong, M., Shen, L., Ge, S., Du, B., & Liu, T. (2022). Robust weight perturbation for adversarial training. arXiv preprint arXiv:2205.14826","DOI":"10.24963\/ijcai.2022\/512"},{"key":"2467_CR46","unstructured":"Zhang, H., Yu, Y., Jiao, J., Xing, E., El\u00a0Ghaoui, L., & Jordan, M. (2019). Theoretically principled trade-off between robustness and accuracy. In: International Conference on Machine Learning, 7472\u20137482. PMLR"},{"key":"2467_CR47","unstructured":"Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., & Gu, Q. (2019). Improving adversarial robustness requires revisiting misclassified examples. In: International Conference on Learning Representations"},{"key":"2467_CR48","unstructured":"Wu, D., Xia, S.-T., & Wang, Y. (2020). Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems 33"},{"key":"2467_CR49","doi-asserted-by":"crossref","unstructured":"Jin, G., Shen, S., Zhang, D., Dai, F., & Zhang, Y. (2019). APE-GAN: adversarial perturbation elimination with GAN. In: International Conference on Acoustics, Speech and Signal Processing, 3842\u20133846","DOI":"10.1109\/ICASSP.2019.8683044"},{"key":"2467_CR50","unstructured":"Zhou, D., Liu, T., Han, B., Wang, N., Peng, C., & Gao, X. (2021). Towards defending against adversarial examples via attack-invariant features. In: Proceedings of the 38th International Conference on Machine Learning, 12835\u201312845"},{"key":"2467_CR51","doi-asserted-by":"crossref","unstructured":"Zhou, D., Wang, N., Peng, C., Gao, X., Wang, X., Yu, J., & Liu, T. (2021). Removing adversarial noise in class activation feature space. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision, 7878\u20137887","DOI":"10.1109\/ICCV48922.2021.00778"},{"key":"2467_CR52","unstructured":"Shi, C., Holtz, C., & Mishne, G. (2021). Online adversarial purification based on self-supervised learning. In: International Conference on Learning Representations"},{"key":"2467_CR53","unstructured":"Guo, C., Rana, M., Ciss\u00e9, M., & Maaten, L. (2018). Countering adversarial images using input transformations. In: 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings"},{"key":"2467_CR54","unstructured":"Das, N., Shanbhogue, M., Chen, S.-T., Hohman, F., Li, S., Chen, L., Kounavis, M.E., & Chau, D.H. (2018). Shield: Fast, practical defense and vaccination for deep learning using jpeg compression. ACM"},{"key":"2467_CR55","unstructured":"Yang, S., Yang, E., Han, B., Liu, Y., Xu, M., Niu, G., & Liu, T. (2022). Estimating instance-dependent bayes-label transition matrix using a deep neural network. In: International Conference on Machine Learning, pp. 25302\u201325312. PMLR"},{"key":"2467_CR56","unstructured":"Xia, X., Liu, T., Han, B., Wang, N., Gong, M., Liu, H., Niu, G., Tao, D., & Sugiyama, M. (2020). Part-dependent label noise: Towards instance-dependent label noise. Advances in Neural Information Processing Systems 33"},{"issue":"3","key":"2467_CR57","doi-asserted-by":"publisher","first-page":"447","DOI":"10.1109\/TPAMI.2015.2456899","volume":"38","author":"T Liu","year":"2015","unstructured":"Liu, T., & Tao, D. (2015). Classification with noisy labels by importance reweighting. IEEE Transactions on pattern analysis and machine intelligence, 38(3), 447\u2013461.","journal-title":"IEEE Transactions on pattern analysis and machine intelligence"},{"key":"2467_CR58","unstructured":"Xia, X., Liu, T., Wang, N., Han, B., Gong, C., Niu, G., & Sugiyama, M. (2019). Are anchor points really indispensable in label-noise learning? arXiv preprint arXiv:1906.00189"},{"key":"2467_CR59","unstructured":"Wu, S., Xia, X., Liu, T., Han, B., Gong, M., Wang, N., Liu, H., & Niu, G. (2021). Class2simi: A noise reduction perspective on learning with noisy labels. In: International Conference on Machine Learning, 11285\u201311295. PMLR"},{"key":"2467_CR60","unstructured":"Xia, X., Liu, T., Han, B., Gong, C., Wang, N., Ge, Z., & Chang, Y. (2021). Robust early-learning: Hindering the memorization of noisy labels. In: International Conference on Learning Representations"},{"key":"2467_CR61","unstructured":"Li, S., Xia, X., Zhang, H., Zhan, Y., Ge, S., & Liu, T. (2022). Estimating noise transition matrix with label correlations for noisy multi-label learning. In: NeurIPS"},{"key":"2467_CR62","unstructured":"Krizhevsky, A., Hinton, G., & et al. (2009). Learning multiple layers of features from tiny images"},{"key":"2467_CR63","unstructured":"Wu, J., Zhang, Q., & Xu, G. (2017). Tiny imagenet challenge. Technical Report"},{"key":"2467_CR64","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., & Sun, J. (2016). Deep residual learning for image recognition. In: Conference on Computer Vision and Pattern Recognition, 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"2467_CR65","doi-asserted-by":"crossref","unstructured":"Zagoruyko, S., & Komodakis, N. (2016). Wide residual networks. In: Wilson, R.C., Hancock, E.R., Smith, W.A.P. (eds.) Proceedings of the British Machine Vision Conference 2016","DOI":"10.5244\/C.30.87"},{"key":"2467_CR66","unstructured":"Kim, H. (2020). Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950"},{"key":"2467_CR67","unstructured":"Ding, G.W., Wang, L., & Jin, X. (2019). Advertorch v0. 1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07623"},{"key":"2467_CR68","doi-asserted-by":"crossref","unstructured":"Andrew, G., & Gao, J. (2007). Scalable training of l 1-regularized log-linear models. In: Proceedings of the 24th International Conference on Machine Learning, 33\u201340","DOI":"10.1145\/1273496.1273501"},{"key":"2467_CR69","unstructured":"Pang, T., Yang, X., Dong, Y., Su, H., & Zhu, J. (2021). Bag of tricks for adversarial training. In: International Conference on Learning Representations"},{"key":"2467_CR70","unstructured":"Rice, L., Wong, E., & Kolter, Z. (2020). Overfitting in adversarially robust deep learning. In: International Conference on Machine Learning, 8093\u20138104. PMLR"},{"key":"2467_CR71","unstructured":"Vinyals, O., Blundell, C., Lillicrap, T., Wierstra, D., & et al. (2016). Matching networks for one shot learning. Advances in neural information processing systems 29"},{"key":"2467_CR72","unstructured":"Athalye, A., Carlini, N., & Wagner, D.A. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In: Proceedings of the 35th International Conference on Machine Learning"},{"key":"2467_CR73","unstructured":"Carlini, N., & Wagner, D. (2017). Magnet and\u201d efficient defenses against adversarial attacks\u201d are not robust to adversarial examples. arXiv preprint arXiv:1711.08478"},{"key":"2467_CR74","unstructured":"Simonyan, K., & Zisserman, A. (2015). Very deep convolutional networks for large-scale image recognition. In: Bengio, Y., LeCun, Y. (eds.) 3rd International Conference on Learning Representations"},{"issue":"4","key":"2467_CR75","doi-asserted-by":"publisher","first-page":"4396","DOI":"10.1109\/TPAMI.2022.3195549","volume":"45","author":"K Zhou","year":"2023","unstructured":"Zhou, K., Liu, Z., Qiao, Y., Xiang, T., & Loy, C. C. (2023). Domain generalization: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(4), 4396\u20134415. https:\/\/doi.org\/10.1109\/TPAMI.2022.3195549","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"2467_CR76","doi-asserted-by":"crossref","unstructured":"Huang, Z., Zhu, M., Xia, X., Shen, L., Yu, J., Gong, C., Han, B., Du, B., & Liu, T. (2023). Robust generalization against photon-limited corruptions via worst-case sharpness minimization. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 16175\u201316185","DOI":"10.1109\/CVPR52729.2023.01552"},{"key":"2467_CR77","doi-asserted-by":"crossref","unstructured":"Zhang, X., He, Y., Xu, R., Yu, H., Shen, Z., & Cui, P. (2023). Nico++: Towards better benchmarking for domain generalization. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 16036\u201316047","DOI":"10.1109\/CVPR52729.2023.01539"},{"issue":"3","key":"2467_CR78","doi-asserted-by":"publisher","first-page":"3047","DOI":"10.1109\/TPAMI.2022.3180545","volume":"45","author":"X Xia","year":"2023","unstructured":"Xia, X., Han, B., Wang, N., Deng, J., Li, J., Mao, Y., & Liu, T. (2023). Extended $$t$$t: Learning with mixed closed-set and open-set noisy labels. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(3), 3047\u20133058. https:\/\/doi.org\/10.1109\/TPAMI.2022.3180545","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"issue":"3","key":"2467_CR79","doi-asserted-by":"publisher","first-page":"1053","DOI":"10.1007\/s10994-022-06211-x","volume":"112","author":"J Li","year":"2023","unstructured":"Li, J., Sun, H., & Li, J. (2023). Beyond confusion matrix: learning from multiple annotators with awareness of instance features. Machine Learning, 112(3), 1053\u20131075.","journal-title":"Machine Learning"},{"key":"2467_CR80","doi-asserted-by":"publisher","unstructured":"Guo, X., Liu, J., Liu, T., & Yuan, Y. (2023). Handling open-set noise and novel target recognition in domain adaptive semantic segmentation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1\u201316 https:\/\/doi.org\/10.1109\/TPAMI.2023.3246392","DOI":"10.1109\/TPAMI.2023.3246392"},{"key":"2467_CR81","doi-asserted-by":"crossref","unstructured":"Zhou, N., Zhou, D., Liu, D., Gao, X., & Wang, N. (2024). Mitigating feature gap for adversarial robustness by feature disentanglement. arXiv preprint arXiv:2401.14707","DOI":"10.1609\/aaai.v39i10.33176"}],"container-title":["International Journal of Computer Vision"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-025-02467-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11263-025-02467-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11263-025-02467-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,9]],"date-time":"2025-09-09T08:05:52Z","timestamp":1757405152000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11263-025-02467-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,14]]},"references-count":81,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2025,9]]}},"alternative-id":["2467"],"URL":"https:\/\/doi.org\/10.1007\/s11263-025-02467-7","relation":{},"ISSN":["0920-5691","1573-1405"],"issn-type":[{"value":"0920-5691","type":"print"},{"value":"1573-1405","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,5,14]]},"assertion":[{"value":"20 May 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 April 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 May 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}