{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T03:19:48Z","timestamp":1780456788746,"version":"3.54.1"},"reference-count":51,"publisher":"Springer Science and Business Media LLC","issue":"11","license":[{"start":{"date-parts":[[2021,1,4]],"date-time":"2021-01-04T00:00:00Z","timestamp":1609718400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2021,1,4]],"date-time":"2021-01-04T00:00:00Z","timestamp":1609718400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Mach. Learn. & Cyber."],"published-print":{"date-parts":[[2021,11]]},"DOI":"10.1007\/s13042-020-01242-z","type":"journal-article","created":{"date-parts":[[2021,1,4]],"date-time":"2021-01-04T11:04:23Z","timestamp":1609758263000},"page":"3325-3336","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":81,"title":["Adversarial examples: attacks and defenses in the physical world"],"prefix":"10.1007","volume":"12","author":[{"given":"Huali","family":"Ren","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Teng","family":"Huang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7261-6398","authenticated-orcid":false,"given":"Hongyang","family":"Yan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,1,4]]},"reference":[{"issue":"7553","key":"1242_CR1","doi-asserted-by":"publisher","first-page":"436","DOI":"10.1038\/nature14539","volume":"521","author":"Y LeCun","year":"2015","unstructured":"LeCun Y, Bengio Y, Hinton G (2015) Deep learning. Nature 521(7553):436\u2013444","journal-title":"Nature"},{"key":"1242_CR2","first-page":"3104","volume-title":"Advances in neural information processing systems","author":"I Sutskever","year":"2014","unstructured":"Sutskever I, Vinyals O, Le QV (2014) Sequence to sequence learning with neural networks. Advances in neural information processing systems. Springer, New York, pp 3104\u20133112"},{"key":"1242_CR3","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"1242_CR4","first-page":"82","volume":"29","author":"A Senior","year":"2012","unstructured":"Senior A, Vanhoucke V, Guyen P, Sainath T et al (2012) Deep neural networks for acoustic modeling in speech recognition. IEEE Signal Process Mag 29:82","journal-title":"IEEE Signal Process Mag"},{"key":"1242_CR5","first-page":"1097","volume-title":"Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems","author":"A Krizhevsky","year":"2012","unstructured":"Krizhevsky A, Sutskever I, Hinton GE (2012) Imagenet classification with deep convolutional neural networks. In Advances in neural information processing systems. Springer, New York, pp 1097\u20131105"},{"key":"1242_CR6","unstructured":"Athalye A, Engstrom L, Ilyas A, Kwok K (2018) Synthesizing robust adversarial examples. In: International conference on machine learning. PMLR, pp 284\u2013 293"},{"issue":"1","key":"1242_CR7","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1186\/s42400-018-0012-9","volume":"1","author":"L Sun","year":"2018","unstructured":"Sun L, Tan M, Zhou Z (2018) A survey of practical adversarial example attacks. Cybersecurity 1(1):9","journal-title":"Cybersecurity"},{"key":"1242_CR8","unstructured":"Szegedy C, Zaremba W, Sutskever I, Bruna J, Erhan D, Goodfellow I, Fergus R (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199"},{"key":"1242_CR9","unstructured":"Goodfellow IJ, Shlens J, Szegedy C (2014) Explaining and harnessing adversarial examples. Comput Sci"},{"key":"1242_CR10","unstructured":"Kurakin A, Goodfellow I, Bengio S (2016) Adversarial examples in the physical world"},{"key":"1242_CR11","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli SM, Fawzi A, Fawzi O, Frossard P (2017) Universal adversarial perturbations","DOI":"10.1109\/CVPR.2017.17"},{"key":"1242_CR12","doi-asserted-by":"crossref","unstructured":"Moosavi-Dezfooli S-M, Fawzi A, Frossard P (2016) Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2574\u20132582","DOI":"10.1109\/CVPR.2016.282"},{"key":"1242_CR13","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2017) Towards evaluating the robustness of neural networks. In: 2017 IEEE symposium on security and privacy (sp). IEEE, pp 39\u201357","DOI":"10.1109\/SP.2017.49"},{"key":"1242_CR14","doi-asserted-by":"crossref","unstructured":"Xie C, Zhang Z, Zhou Y, Bai S, Wang J, Ren Z, Yuille AL (2019) Improving transferability of adversarial examples with input diversity. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 2730\u20132739","DOI":"10.1109\/CVPR.2019.00284"},{"key":"1242_CR15","doi-asserted-by":"crossref","unstructured":"Dong Y, Liao F, Pang T, Su H, Zhu J, Hu X, Li J (2018) Boosting adversarial attacks with momentum. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 9185\u20139193","DOI":"10.1109\/CVPR.2018.00957"},{"key":"1242_CR16","unstructured":"Miyato T, Dai AM, Goodfellow I (2016) Adversarial training methods for semi-supervised text classification. arXiv preprint arXiv:1605.07725"},{"key":"1242_CR17","doi-asserted-by":"crossref","unstructured":"Zheng S, Song Y, Leung T, Goodfellow I (2016) Improving the robustness of deep neural networks via stability training. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 4480\u20134488","DOI":"10.1109\/CVPR.2016.485"},{"key":"1242_CR18","unstructured":"Buckman J, Roy A, Raffel C, Goodfellow I (2018) Thermometer encoding: one hot way to resist adversarial examples. In: International conference on learning representations"},{"key":"1242_CR19","unstructured":"Song Y, Kim T, Nowozin S, Ermon S, Kushman N (2017) Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. arXiv preprint arXiv:1710.10766"},{"key":"1242_CR20","unstructured":"Xie C, Wang J, Zhang Z, Ren Z, Yuille A (2017) Mitigating adversarial effects through randomization. arXiv preprint arXiv:1711.01991"},{"key":"1242_CR21","doi-asserted-by":"crossref","unstructured":"Xu W, Evans D, Qi Y (2017) Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155","DOI":"10.14722\/ndss.2018.23198"},{"key":"1242_CR22","doi-asserted-by":"crossref","unstructured":"Akhtar N, Liu J, Mian A (2018) Defense against universal adversarial perturbations. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 3389\u20133398","DOI":"10.1109\/CVPR.2018.00357"},{"key":"1242_CR23","unstructured":"Zhou H, Li W, Zhu Y, Zhang Y, Yu B, Zhang L, Liu C (2018) Deepbillboard: systematic physical-world testing of autonomous driving systems"},{"key":"1242_CR24","doi-asserted-by":"crossref","unstructured":"Patel N, Krishnamurthy P, Garg S, Khorrami F (2019) Adaptive adversarial videos on roadside billboards: dynamically modifying trajectories of autonomous vehicles. In: 2019 IEEE\/RSJ International conference on intelligent robots and systems (IROS)","DOI":"10.1109\/IROS40897.2019.8968267"},{"key":"1242_CR25","doi-asserted-by":"crossref","unstructured":"Sato T, Shen J, Wang N, Jia YJ, Lin X, Chen QA (2020) Security of deep learning based lane keeping system under physical-world adversarial attack","DOI":"10.14722\/autosec.2021.23026"},{"key":"1242_CR26","doi-asserted-by":"crossref","unstructured":"Thys S, Van Ranst W, Goedem\u00e9 T (2019) Fooling automated surveillance cameras: adversarial patches to attack person detection","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"1242_CR27","doi-asserted-by":"crossref","unstructured":"Liu A, Liu X, Fan J, Ma Y, Tao D (2019) Perceptual-sensitive gan for generating adversarial patches. In: Proceedings of the AAAI conference on artificial intelligence, vol 33, pp 1028\u20131035","DOI":"10.1609\/aaai.v33i01.33011028"},{"key":"1242_CR28","unstructured":"Li J, Schmidt FR, Kolter JZ (2019) Adversarial camera stickers: a physical camera-based attack on deep learning systems"},{"key":"1242_CR29","unstructured":"Zhou Z, Tang D, Wang X, Han W, Liu X, Zhang K (2018) Invisible mask: practical attacks on face recognition with infrared"},{"key":"1242_CR30","doi-asserted-by":"crossref","unstructured":"Cao Y, Xiao C, Cyr B, Zhou Y, Park W, Rampazzi S, Chen QA, Fu K, Mao ZM (2019) Adversarial sensor attack on lidar-based perception in autonomous driving. In: Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp 2267\u20132281","DOI":"10.1145\/3319535.3339815"},{"key":"1242_CR31","doi-asserted-by":"crossref","unstructured":"Eykholt K, Evtimov I, Fernandes E, Li B, Rahmati A, Xiao C, Prakash A, Kohno T, Song D (2018) Robust physical-world attacks on deep learning models. In: 2018 IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","DOI":"10.1109\/CVPR.2018.00175"},{"key":"1242_CR32","doi-asserted-by":"crossref","unstructured":"Sharif M, Bhagavatula S, Bauer L, Reiter MK (2016) Accessorize to a crime: real and stealthy attacks on state-of-the-art face recognition. In: Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, pp 1528\u20131540","DOI":"10.1145\/2976749.2978392"},{"key":"1242_CR33","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Goodfellow I, Jha S, Celik ZB, Swami A (2017) Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp 506\u2013519","DOI":"10.1145\/3052973.3053009"},{"key":"1242_CR34","doi-asserted-by":"crossref","unstructured":"Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A (2016) The limitations of deep learning in adversarial settings. In: 2016 IEEE European symposium on security and privacy (EuroS & P). IEEE, pp 372\u2013387","DOI":"10.1109\/EuroSP.2016.36"},{"issue":"5","key":"1242_CR35","doi-asserted-by":"publisher","first-page":"828","DOI":"10.1109\/TEVC.2019.2890858","volume":"23","author":"J Su","year":"2019","unstructured":"Su J, Vargas DV, Sakurai K (2019) One pixel attack for fooling deep neural networks. IEEE Trans Evol Comput 23(5):828\u2013841","journal-title":"IEEE Trans Evol Comput"},{"issue":"11","key":"1242_CR36","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y, Haffner P (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324","journal-title":"Proc IEEE"},{"key":"1242_CR37","unstructured":"Simonyan K, Zisserman A (2014) Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556"},{"key":"1242_CR38","doi-asserted-by":"crossref","unstructured":"Girshick R (2015) Fast R-CNN. In: Proceedings of the IEEE international conference on computer vision, pp 1440\u20131448","DOI":"10.1109\/ICCV.2015.169"},{"key":"1242_CR39","unstructured":"Ren S, He K, Girshick R, Sun J (2015) Faster R-CNN: towards real-time object detection with region proposal networks. In Advances in neural information processing systems, pp 91\u201399"},{"key":"1242_CR40","doi-asserted-by":"crossref","unstructured":"He K, Gkioxari G, Doll\u00e1r P, Girshick R (2017) Mask R-CNN. In: Proceedings of the IEEE international conference on computer vision, pp 2961\u20132969","DOI":"10.1109\/ICCV.2017.322"},{"key":"1242_CR41","doi-asserted-by":"crossref","unstructured":"Redmon J, Farhadi A (2017) Yolo9000: better, faster, stronger. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 7263\u20137271","DOI":"10.1109\/CVPR.2017.690"},{"key":"1242_CR42","doi-asserted-by":"crossref","unstructured":"Liu W, Anguelov D, Erhan D, Szegedy C, Reed S, Fu C-Y, Berg AC (2016) Ssd: Single shot multibox detector, in European conference on computer vision. Springer, pp. 21\u201337","DOI":"10.1007\/978-3-319-46448-0_2"},{"key":"1242_CR43","doi-asserted-by":"crossref","unstructured":"Wu Z, Lim SN, Davis L, Goldstein T (2019) Making an invisibility cloak: real world adversarial attacks on object detectors","DOI":"10.1007\/978-3-030-58548-8_1"},{"key":"1242_CR44","unstructured":"Cao Y, Xiao C, Yang D, Fang J, Yang R, Liu M, Li B (2019) Adversarial objects against lidar-based autonomous driving systems"},{"key":"1242_CR45","doi-asserted-by":"crossref","unstructured":"Tu J, Ren M, Manivasagam S, Liang M, Yang B, Du R, Cheng F, Urtasun R (2020) Physically realizable adversarial examples for lidar object detection","DOI":"10.1109\/CVPR42600.2020.01373"},{"key":"1242_CR46","doi-asserted-by":"crossref","unstructured":"Carlini N, Wagner D (2018) Audio adversarial examples: targeted attacks on speech-to-text. In: 2018 IEEE security and privacy workshops (SPW). IEEE, pp 1\u20137","DOI":"10.1109\/SPW.2018.00009"},{"key":"1242_CR47","unstructured":"Hannun A, Case C, Casper J, Catanzaro B, Diamos G, Elsen E, Prenger R, Satheesh S, Sengupta S, Coates et al A (2014) Deep speech: scaling up end-to-end speech recognition. arXiv preprint arXiv:1412.5567"},{"key":"1242_CR48","doi-asserted-by":"crossref","unstructured":"Zhang G, Yan C, Ji X, Zhang T, Zhang T, Xu W (2017) Dolphinattack: Inaudible voice commands. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp 103\u2013117","DOI":"10.1145\/3133956.3134052"},{"key":"1242_CR49","doi-asserted-by":"crossref","unstructured":"Taori R, Kamsetty A, Chu B, Vemuri N (2019) Targeted adversarial examples for black box audio systems. In: 2019 IEEE security and privacy workshops (SPW). IEEE, pp 15\u201320","DOI":"10.1109\/SPW.2019.00016"},{"key":"1242_CR50","unstructured":"Wu T, Tong L, Vorobeychik Y (2019) Defending against physically realizable attacks on image classification"},{"key":"1242_CR51","doi-asserted-by":"crossref","unstructured":"Xu Z, Yu F, Chen X (2020) Lance: A comprehensive and lightweight CNN defense methodology against physical adversarial attacks on embedded multimedia applications. In: 2020 25th Asia and South Pacific Design Automation Conference (ASP-DAC). IEEE, pp 470\u2013475","DOI":"10.1109\/ASP-DAC47756.2020.9045584"}],"container-title":["International Journal of Machine Learning and Cybernetics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-020-01242-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s13042-020-01242-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-020-01242-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,12,10]],"date-time":"2022-12-10T10:50:35Z","timestamp":1670669435000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s13042-020-01242-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,4]]},"references-count":51,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2021,11]]}},"alternative-id":["1242"],"URL":"https:\/\/doi.org\/10.1007\/s13042-020-01242-z","relation":{},"ISSN":["1868-8071","1868-808X"],"issn-type":[{"value":"1868-8071","type":"print"},{"value":"1868-808X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,1,4]]},"assertion":[{"value":"2 September 2020","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"19 November 2020","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 January 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}