{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,18]],"date-time":"2025-09-18T10:36:50Z","timestamp":1758191810034,"version":"3.44.0"},"reference-count":53,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/access.2025.3608117","type":"journal-article","created":{"date-parts":[[2025,9,10]],"date-time":"2025-09-10T17:47:52Z","timestamp":1757526472000},"page":"158887-158905","source":"Crossref","is-referenced-by-count":0,"title":["Game Theoretic Mixed Experts for Combinational Adversarial Machine Learning"],"prefix":"10.1109","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7672-4449","authenticated-orcid":false,"given":"Kaleel","family":"Mahmood","sequence":"first","affiliation":[{"name":"Department of Computer Science and Statistics, The University of Rhode Island, Kingston, RI, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ethan","family":"Rathbun","sequence":"additional","affiliation":[{"name":"Khoury College of Computer Sciences, Northeastern University, Boston, MA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-5175-1831","authenticated-orcid":false,"given":"Ronak","family":"Sahu","sequence":"additional","affiliation":[{"name":"School of Computing, University of Connecticut, Storrs, CT, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9388-8050","authenticated-orcid":false,"given":"Marten","family":"Van Dijk","sequence":"additional","affiliation":[{"name":"CWI Amsterdam, Amsterdam, XG, The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sohaib","family":"Ahmad","sequence":"additional","affiliation":[{"name":"Visa Inc., San Francisco, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0891-1231","authenticated-orcid":false,"given":"Caiwen","family":"Ding","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, University of Minnesota, Minneapolis, MN, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.385"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65965-3_11"},{"key":"ref3","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref4","article-title":"Nash equilibria and pitfalls of adversarial training in adversarial robustness games","author":"Balcan","year":"2022","journal-title":"arXiv:2210.12606"},{"key":"ref5","article-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019","journal-title":"arXiv:1902.06705"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11302"},{"key":"ref9","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2025.07.114"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Dosovitskiy","key":"ref12"},{"key":"ref13","first-page":"21056","article-title":"Deep residual learning in spiking neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Fang"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"ref15","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref16","first-page":"3976","article-title":"Knowledge enhanced machine learning pipeline against diverse adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"G\u00fcrel"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref18","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ho"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58558-7_29"},{"article-title":"CIFAR-10 (Canadian institute for advanced research)","year":"2010","author":"Krizhevsky","key":"ref20"},{"article-title":"CIFAR-10 (Canadian institute for advanced research)","year":"2009","author":"Krizhevsky","key":"ref21"},{"key":"ref22","first-page":"11438","article-title":"On global-view based defense via adversarial attack and defense risk guaranteed bounds","volume-title":"Proc. Mach. Learn. Res.","volume":"151","author":"Le"},{"issue":"7","key":"ref23","first-page":"3","article-title":"Tiny imagenet visual recognition challenge","volume":"7","author":"Le","year":"2015"},{"key":"ref24","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"Liu","year":"2016","journal-title":"arXiv:1611.02770"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.3390\/e23101359"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"ref28","first-page":"6640","article-title":"Adversarial robustness against the union of multiple perturbation models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Maini"},{"key":"ref29","first-page":"7677","article-title":"Mixed Nash equilibria in the adversarial examples game","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Meunier"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.2307\/1969529"},{"key":"ref31","first-page":"1345","article-title":"A game theoretic analysis of additive adversarial attacks and defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Pal"},{"key":"ref32","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref33","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016","journal-title":"arXiv:1605.07277"},{"key":"ref34","first-page":"7717","article-title":"Randomization matters how to defend against strong adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pinot"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2020.2975048"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00669"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2021.3111897"},{"article-title":"Adversarially robust generalization requires more data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Schmidt","key":"ref38"},{"key":"ref39","article-title":"Robust learning meets generative models: Can proxy distributions improve adversarial robustness?","author":"Sehwag","year":"2021","journal-title":"arXiv:2104.09425"},{"key":"ref40","first-page":"1","article-title":"MTDeep: Boosting the security of deep neural nets against adversarial attacks with moving target defense","volume-title":"Proc. 32nd AAAI Conf. Artif. Intell. Workshops","author":"Sengupta"},{"key":"ref41","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv:1409.1556"},{"key":"ref42","first-page":"20232","article-title":"Demystifying the adversarial robustness of random transformation defenses","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Sitawarin"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00714"},{"article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Tram\u00e8r","key":"ref44"},{"key":"ref45","article-title":"Guided diffusion model for adversarial purification","author":"Wang","year":"2022","journal-title":"arXiv:2205.14969"},{"key":"ref46","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref47","first-page":"36246","article-title":"Better diffusion models further improve adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wang"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00049"},{"key":"ref49","article-title":"Attacking the spike: On the transferability and security of spiking neural networks to adversarial examples","author":"Xu","year":"2022","journal-title":"arXiv:2209.03358"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1049\/csy2.12117"},{"key":"ref51","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref52","first-page":"11278","article-title":"Attacks which do not kill training make adversarial learning stronger","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2024.3416308"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/6287639\/10820123\/11155075.pdf?arnumber=11155075","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,17]],"date-time":"2025-09-17T17:32:28Z","timestamp":1758130348000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11155075\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":53,"URL":"https:\/\/doi.org\/10.1109\/access.2025.3608117","relation":{},"ISSN":["2169-3536"],"issn-type":[{"type":"electronic","value":"2169-3536"}],"subject":[],"published":{"date-parts":[[2025]]}}}