{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T17:07:37Z","timestamp":1784394457359,"version":"3.55.0"},"reference-count":218,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U1804263"],"award-info":[{"award-number":["U1804263"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61702105"],"award-info":[{"award-number":["61702105"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2020.3045078","type":"journal-article","created":{"date-parts":[[2020,12,15]],"date-time":"2020-12-15T21:10:08Z","timestamp":1608066608000},"page":"4566-4593","source":"Crossref","is-referenced-by-count":253,"title":["Privacy and Security Issues in Deep Learning: A Survey"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4238-3295","authenticated-orcid":false,"given":"Ximeng","family":"Liu","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3194-1447","authenticated-orcid":false,"given":"Lehui","family":"Xie","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3546-6364","authenticated-orcid":false,"given":"Yaopeng","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jian","family":"Zou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9985-1953","authenticated-orcid":false,"given":"Jinbo","family":"Xiong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1658-4931","authenticated-orcid":false,"given":"Zuobin","family":"Ying","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Athanasios V.","family":"Vasilakos","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1145\/1390156.1390294"},{"key":"ref172","first-page":"234","article-title":"U-net: Convolutional networks for biomedical image segmentation","author":"ronneberger","year":"2015","journal-title":"Proc Int Conf Med Image Comput -Assist Intervent"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref174","article-title":"Adversarially learned inference","author":"dumoulin","year":"2016","journal-title":"arXiv 1606 00704"},{"key":"ref173","article-title":"On the robustness of the CVPR 2018 white-box adversarial example defenses","author":"athalye","year":"2018","journal-title":"arXiv 1804 03286"},{"key":"ref176","article-title":"Featurized bidirectional gan: Adversarial defense via adversarially learned semantic inference","author":"bao","year":"2018","journal-title":"arXiv 1805 07862"},{"key":"ref175","article-title":"Adversarial feature learning","author":"donahue","year":"2016","journal-title":"arXiv 1605 09782"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1109\/83.862633"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2019.2940533"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1109\/TASSP.1979.1163188"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-32009-5_50"},{"key":"ref38","article-title":"Somewhat practical fully homomorphic encryption","author":"fan","year":"2012"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/359340.359342"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2573770"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2536601"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2585121"},{"key":"ref37","article-title":"On-the-fly multiparty computation on the cloud via multikey fully homomorphic encryption","author":"lopez-alt","year":"2013"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40041-4_5"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/1536414.1536440"},{"key":"ref34","doi-asserted-by":"crossref","first-page":"469","DOI":"10.1109\/TIT.1985.1057074","article-title":"A public key cryptosystem and a signature scheme based on discrete logarithms","volume":"31","author":"elgamal","year":"1985","journal-title":"IEEE Trans Inf Theory"},{"key":"ref181","article-title":"Learning with a strong adversary","author":"huang","year":"2015","journal-title":"arXiv 1511 03034"},{"key":"ref180","article-title":"Efficient two-step adversarial defense for deep neural networks","author":"chang","year":"2018","journal-title":"arXiv 1810 03739"},{"key":"ref185","article-title":"Feature prioritization and regularization improve standard accuracy and adversarial robustness","author":"liu","year":"2018","journal-title":"arXiv 1810 02424"},{"key":"ref184","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"2017","journal-title":"arXiv 1705 07204"},{"key":"ref183","article-title":"Adversarial logit pairing","author":"kannan","year":"2018","journal-title":"arXiv 1803 06373"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2018.04.027"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01171"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.459"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7299149"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-79228-4_1"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.151"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48910-X_16"},{"key":"ref20","article-title":"Poisoning attacks with generative adversarial nets","author":"mu\u00f1oz-gonz\u00e1lez","year":"2019","journal-title":"arXiv 1906 07773"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2807385"},{"key":"ref21","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"arXiv 1412 6572"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2019.11.041"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30619-9_4"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2805680"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2018.2886017"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134012"},{"key":"ref51","first-page":"2672","article-title":"Generative adversarial nets","author":"goodfellow","year":"2014","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref154","article-title":"Invisible mask: Practical attacks on face recognition with infrared","author":"zhou","year":"2018","journal-title":"arXiv 1803 04683"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098158"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2943467"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref146","first-page":"91","article-title":"Faster R-CNN: Towards real-time object detection with region proposal networks","author":"ren","year":"2015","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref147","article-title":"Note on attacking object detectors with adversarial stickers","author":"eykholt","year":"2017","journal-title":"arXiv 1712 08062"},{"key":"ref148","first-page":"52","article-title":"ShapeShifter: Robust physical adversarial attack on faster R-CNN object detector","author":"chen","year":"2018","journal-title":"Proc Eur Conf Mach Learn Knowl Discovery Databases"},{"key":"ref149","article-title":"Adversarial patch","author":"brown","year":"2017","journal-title":"arXiv 1712 09665"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2855136"},{"key":"ref58","doi-asserted-by":"crossref","first-page":"211","DOI":"10.1561\/0400000042","article-title":"The algorithmic foundations of differential privacy","volume":"9","author":"dwork","year":"2014","journal-title":"Found Trends Theor Comput Sci"},{"key":"ref57","article-title":"Differentially private generative adversarial network","author":"xie","year":"2018","journal-title":"arXiv 1701 04722"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/FOCS.2010.12"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978318"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00065"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2019-0008"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00029"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-45239-0_4"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/83.136597"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00669"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2005.38"},{"key":"ref164","author":"xu","year":"2017","journal-title":"Feature squeezing mitigates and detects carlini\/wagner adversarial examples"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1145\/383259.383296"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1016\/0167-2789(92)90242-F"},{"key":"ref161","author":"das","year":"2017","journal-title":"Keeping the bad guys out Protecting and vaccinating deep learning with JPEG compression"},{"key":"ref160","article-title":"A study of the effect of JPG compression on adversarial images","author":"dziugaite","year":"2016","journal-title":"arXiv 1608 00853"},{"key":"ref4","first-page":"1988","article-title":"Deep learning face representation by joint identification-verification","author":"sun","year":"2014","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TASL.2011.2134090"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1146\/annurev-bioeng-071516-044442"},{"key":"ref5","article-title":"DeepID3: Face recognition with very deep neural networks","author":"sun","year":"2015","journal-title":"arXiv 1502 00873"},{"key":"ref8","doi-asserted-by":"crossref","first-page":"484","DOI":"10.1038\/nature16961","article-title":"Mastering the game of go with deep neural networks and tree search","volume":"529","author":"silver","year":"2016","journal-title":"Nature"},{"key":"ref159","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2007.01.009"},{"key":"ref49","article-title":"ML-leaks: Model and data independent membership inference attacks and defenses on machine learning models","author":"salem","year":"2018","journal-title":"arXiv 1806 01246"},{"key":"ref157","author":"ho","year":"2018","journal-title":"Pixel Redrawn for a Robust Adversarial Defense"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1038\/s41586-019-1724-z"},{"key":"ref158","article-title":"Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms","author":"xiao","year":"2017","journal-title":"ArXiv 1708 07747"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682202"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/359168.359176"},{"key":"ref48","article-title":"Have you stolen my model? Evasion attacks against deep neural network watermarking techniques","author":"hitaj","year":"2018","journal-title":"arXiv 1809 00615"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3078974"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/SFCS.1986.25"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2816656"},{"key":"ref44","article-title":"How to exchange secrets with oblivious transfer","author":"rabin","year":"2005"},{"key":"ref43","first-page":"307","author":"goldreich","year":"2019","journal-title":"How to play any mental game or a completeness theorem for protocols with an honest majority"},{"key":"ref73","first-page":"35","article-title":"Privacy-preserving classification on deep neural network","volume":"2017","author":"chabanne","year":"2017","journal-title":"IACR Cryptol ePrint Arch"},{"key":"ref72","first-page":"45","article-title":"Improved security for a ring-based fully homomorphic encryption scheme","author":"bos","year":"2013","journal-title":"IMA Int Conf Crypt & Coding"},{"key":"ref71","first-page":"201","article-title":"CryptoNets: Applying neural networks to encrypted data with high throughput and accuracy","author":"gilad-bachrach","year":"2016","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref70","article-title":"Crypto-nets: Neural networks over encrypted data","author":"xie","year":"2014","journal-title":"arXiv 1412 6181"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-96878-0_17"},{"key":"ref77","first-page":"4490","article-title":"TAPAS: Tricks to accelerate (encrypted) prediction as a service","author":"sanyal","year":"2018","journal-title":"Proc 35th Int Conf Mach Learn"},{"key":"ref74","first-page":"448","article-title":"Batch normalization: Accelerating deep network training by reducing internal covariate shift","author":"ioffe","year":"2015","journal-title":"Proc ICML"},{"key":"ref75","article-title":"CryptoDL: Deep neural networks over encrypted data","author":"hesamifard","year":"2017","journal-title":"arXiv 1711 05189"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-53887-6_1"},{"key":"ref79","article-title":"Binarynet: Training deep neural networks with weights and activations constrained to +1 or ?1","author":"courbariaux","year":"2016","journal-title":"arXiv 1602 02830 [cs]"},{"key":"ref60","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"lecun","year":"2015","journal-title":"Nature"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1162\/089976698300017467"},{"key":"ref61","article-title":"Auto-encoding variational Bayes","author":"kingma","year":"2013","journal-title":"arXiv 1312 6114"},{"key":"ref63","first-page":"1309","article-title":"Differential privacy preservation for deep auto-encoders: An application of human behavior prediction","author":"phan","year":"2016","journal-title":"Proc 30th AAAI Conf Artif Intell"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-017-5656-2"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2017.48"},{"key":"ref66","article-title":"Semi-supervised knowledge transfer for deep learning from private training data","author":"papernot","year":"2016","journal-title":"arXiv 1610 05755"},{"key":"ref67","author":"lecun","year":"2010","journal-title":"MNIST Handwritten Digit Database"},{"key":"ref68","article-title":"Scalable private learning with PATE","author":"papernot","year":"2018","journal-title":"arXiv 1802 08908"},{"key":"ref69","author":"triastcyn","year":"2018","journal-title":"Generating differentially private datasets using GANs"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140451"},{"key":"ref198","article-title":"Generative poisoning attack method against neural networks","author":"yang","year":"2017","journal-title":"arXiv 1703 01340"},{"key":"ref199","first-page":"1885","article-title":"Understanding black-box predictions via influence functions","volume":"70","author":"koh","year":"2017","journal-title":"Proc Int Conf Mach Learn (JMLR)"},{"key":"ref193","first-page":"4139","article-title":"Detecting adversarial examples through image transformation","author":"tian","year":"2018","journal-title":"Proc 32nd AAAI Conf Artif Intell"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2874243"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2018.00093"},{"key":"ref196","first-page":"7913","article-title":"Robust detection of adversarial attacks by modeling the intrinsic properties of deep neural networks","author":"zheng","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10590-1_53"},{"key":"ref94","article-title":"Securing input data of deep learning inference systems via partitioned enclave execution","author":"gu","year":"2018","journal-title":"arXiv 1807 00969"},{"key":"ref190","article-title":"Blocking transferability of adversarial examples in black-box learning systems","author":"hosseini","year":"2017","journal-title":"arXiv 1703 04318"},{"key":"ref93","first-page":"578","article-title":"TVM: An automated end-to-end optimizing compiler for deep learning","author":"chen","year":"2018","journal-title":"Proc of USENIX Symp on Operating Systems Design and Implementation (OSDI)"},{"key":"ref191","first-page":"30","article-title":"Stateful detection of black-box adversarial attacks","author":"chen","year":"2019","journal-title":"Proc 1st ACM Workshop Secur Privacy Artif Intell"},{"key":"ref92","article-title":"Efficient deep learning on multi-source private data","author":"hynes","year":"2018","journal-title":"arXiv 1807 06689"},{"key":"ref192","article-title":"Black-box adversarial attacks with limited queries and information","author":"ilyas","year":"2018","journal-title":"arXiv 1804 08598"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/3231594"},{"key":"ref90","article-title":"Chiron: Privacy-preserving machine learning as a service","author":"hunt","year":"2018","journal-title":"arXiv 1803 05961"},{"key":"ref98","article-title":"MLCapsule: Guarded offline deployment of machine learning as a service","author":"hanzlik","year":"2018","journal-title":"arXiv 1808 00590"},{"key":"ref99","article-title":"Defending against machine learning model stealing attacks using deceptive perturbations","author":"lee","year":"2018","journal-title":"arXiv 1806 00054"},{"key":"ref96","article-title":"Slalom: Fast, verifiable and private execution of neural networks in trusted hardware","author":"tramer","year":"2019","journal-title":"Proc Int Conf Learn Represent (ICLR)ICLR"},{"key":"ref97","first-page":"842","article-title":"Probabilistic machines can use less running time","volume":"839","author":"freivalds","year":"1977","journal-title":"Proc IFIP Congr"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.12"},{"key":"ref81","first-page":"1310","article-title":"Privacy-preserving deep learning","author":"shokri","year":"2015","journal-title":"Proc 53rd Annu Allerton Conf Commun Control Comput (Allerton)"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3195970.3196023"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134056"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2787987"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/2487726.2488368"},{"key":"ref85","first-page":"1651","article-title":"GAZELLE: A low latency framework for secure neural network inference","author":"juvekar","year":"2018","journal-title":"Proc 7th USENIX Secur Symp (USENIX Secur )"},{"key":"ref86","first-page":"442","article-title":"SecureNN: Efficient and private neural network training","volume":"2018","author":"wagh","year":"2018","journal-title":"IACR Cryptol ePrint Arch"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-020-00057-3"},{"key":"ref88","first-page":"619","article-title":"Oblivious multi-party machine learning on trusted processors","author":"ohrimenko","year":"2016","journal-title":"Proc 25th USENIX Secur Symp (USENIX Secur )"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1080\/00401706.1980.10486199"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1145\/2996758.2996762"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3021407"},{"key":"ref204","first-page":"3517","article-title":"Certified defenses for data poisoning attacks","author":"steinhardt","year":"2017","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref201","first-page":"6103","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","author":"shafahi","year":"2018","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref202","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"chen","year":"2017","journal-title":"arXiv 1712 05526"},{"key":"ref207","first-page":"1689","article-title":"Is feature selection secure against training data poisoning?","author":"xiao","year":"2015","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref208","article-title":"Detection of adversarial training examples in poisoning attacks through anomaly detection","author":"paudice","year":"2018","journal-title":"arXiv 1802 03041"},{"key":"ref205","first-page":"1467","article-title":"Poisoning attacks against support vector machines","author":"biggio","year":"2012","journal-title":"Proc ICML"},{"key":"ref206","first-page":"2871","article-title":"Using machine teaching to identify optimal training-set attacks on machine learners","author":"mei","year":"2015","journal-title":"Proc 29th AAAI Conf Artif Intell"},{"key":"ref211","article-title":"Robust physical-world attacks on deep learning models","author":"eykholt","year":"2017","journal-title":"arXiv 1707 08945"},{"key":"ref210","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"chen","year":"2018","journal-title":"arXiv 1811 03728"},{"key":"ref212","article-title":"Transferable adversarial attacks for image and video object detection","author":"wei","year":"2018","journal-title":"arXiv 1811 12641"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.300"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref215","first-page":"479","article-title":"Misleading authorship attribution of source code using adversarial learning","author":"quiring","year":"2019","journal-title":"Proc 28th USENIX Secur Symp (USENIX Secur )"},{"key":"ref216","article-title":"Query-efficient hard-label black-box attack: An optimization-based approach","author":"cheng","year":"2018","journal-title":"arXiv 1807 04457"},{"key":"ref217","article-title":"On adaptive attacks to adversarial example defenses","author":"tramer","year":"2020","journal-title":"arXiv 2002 08347"},{"key":"ref218","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2006.872133"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1023\/A:1008202821328"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref124","first-page":"284","article-title":"Synthesizing robust adversarial examples","author":"athalye","year":"2018","journal-title":"Proc PMLR"},{"key":"ref129","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2017","journal-title":"arXiv 1711 00117"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2010.2059031"},{"key":"ref130","article-title":"Image transformation can make neural networks more robust against adversarial examples","author":"duy thang","year":"2019","journal-title":"arXiv 1901 03037"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1111\/j.1478-4408.1976.tb03301.x"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref131","article-title":"Foveation-based mechanisms alleviate adversarial examples","author":"luo","year":"2015","journal-title":"arXiv 1511 06292"},{"key":"ref132","article-title":"NO need to worry about adversarial examples in object detection in autonomous vehicles","author":"lu","year":"2017","journal-title":"arXiv 1707 03501"},{"key":"ref136","article-title":"Adam: A method for stochastic optimization","author":"kingma","year":"2014","journal-title":"arXiv 1412 6980"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-7946-8"},{"key":"ref138","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"brendel","year":"2017","journal-title":"arXiv 1712 04248"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00506"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1145\/325165.325247"},{"key":"ref141","first-page":"1277","article-title":"HopSkipJumpAttack: A query-efficient decision-based attack","author":"chen","year":"2020","journal-title":"Proc IEEE Symp Secur Privacy (SP)"},{"key":"ref142","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"liu","year":"2016","journal-title":"arXiv 1611 02770"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2205597"},{"key":"ref144","article-title":"Standard detectors aren’t (currently) fooled by physical adversarial stop signs","author":"lu","year":"2017","journal-title":"arXiv 1710 03337"},{"key":"ref1","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","author":"krizhevsky","year":"2012","journal-title":"Proc Adv Neural Inf Process Syst"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.690"},{"key":"ref109","first-page":"1615","article-title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","author":"adi","year":"2018","journal-title":"Proc 7th USENIX Secur Symp (USENIX Secur )"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196550"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363201"},{"key":"ref106","first-page":"1895","article-title":"Evaluating differentially private machine learning in practice","author":"jayaraman","year":"2019","journal-title":"Proc 28th USENIX Secur Symp (USENIX Secur )"},{"key":"ref105","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model","volume":"11","author":"rahman","year":"2018","journal-title":"Trans Data Privacy"},{"key":"ref104","first-page":"267","article-title":"The secret sharer: Evaluating and testing unintended memorization in neural networks","author":"carlini","year":"2019","journal-title":"Proc 28th USENIX Secur Symp (USENIX Secur )"},{"key":"ref103","article-title":"Towards measuring membership privacy","author":"long","year":"2017","journal-title":"arXiv 1712 09136"},{"key":"ref102","first-page":"555","article-title":"Learning privately from multiparty data","author":"hamm","year":"2016","journal-title":"Proc Int Conf Mach Learn"},{"key":"ref111","article-title":"Deepsigns: A generic watermarking framework for ip protection of deep learning models","author":"rouhani","year":"2018","journal-title":"arXiv 1804 00750"},{"key":"ref112","author":"fletcher","year":"2013","journal-title":"Practical Methods of Optimization"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-019-04434-z"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/MWC.001.1900463"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref12","article-title":"Transferable clean-label poisoning attacks on deep neural nets","author":"zhu","year":"2019","journal-title":"arXiv 1905 05897"},{"key":"ref13","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"gu","year":"2017","journal-title":"arXiv 1708 06733"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref15","first-page":"601","article-title":"Stealing machine learning models via prediction apis","author":"tram\u00e8r","year":"2016","journal-title":"Proc 25th USENIX Secur Symp (USENIX Secur )"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref18","article-title":"Understanding membership inferences on well-generalized learning models","author":"long","year":"2018","journal-title":"arXiv 1802 04889"},{"key":"ref19","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2013","journal-title":"arXiv 1312 6199"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref114","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref113","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"2016","journal-title":"arXiv 1611 01236"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref120","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2017","journal-title":"arXiv 1711 00117"},{"key":"ref121","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref122","author":"samangouei","year":"2018","journal-title":"Defense-GAN Protecting classifiers against adversarial attacks using generative models"},{"key":"ref123","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc 35th Int Conf Mach Learn (ICML)"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09294026.pdf?arnumber=9294026","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:55:36Z","timestamp":1639770936000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9294026\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":218,"URL":"https:\/\/doi.org\/10.1109\/access.2020.3045078","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}