{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T15:40:14Z","timestamp":1780501214666,"version":"3.54.1"},"reference-count":46,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,6,4]],"date-time":"2023-06-04T00:00:00Z","timestamp":1685836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,6,4]],"date-time":"2023-06-04T00:00:00Z","timestamp":1685836800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,6,4]]},"DOI":"10.1109\/icassp49357.2023.10097245","type":"proceedings-article","created":{"date-parts":[[2023,5,5]],"date-time":"2023-05-05T13:28:30Z","timestamp":1683293310000},"page":"1-5","source":"Crossref","is-referenced-by-count":24,"title":["Visual Prompting for Adversarial Robustness"],"prefix":"10.1109","author":[{"given":"Aochuan","family":"Chen","sequence":"first","affiliation":[{"name":"Michigan State University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peter","family":"Lorenz","sequence":"additional","affiliation":[{"name":"Fraunhofer ITWM and Fraunhofer Center of Machine Learning,Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuguang","family":"Yao","sequence":"additional","affiliation":[{"name":"Michigan State University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Pin-Yu","family":"Chen","sequence":"additional","affiliation":[{"name":"IBM Research,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sijia","family":"Liu","sequence":"additional","affiliation":[{"name":"Michigan State University,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","article-title":"Evaluating the adversarial robustness of adaptive test-time defenses","author":"croce","year":"2022","journal-title":"arXiv 2202 13711"},{"key":"ref35","article-title":"On detecting adversarial perturbations","author":"metzen","year":"2017","journal-title":"arXiv 1702 04267"},{"key":"ref12","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","author":"croce","year":"2020","journal-title":"ICML"},{"key":"ref34","article-title":"Ml-loo: Detecting adversarial examples with feature attribution","author":"yang","year":"2019","journal-title":"arXiv 1906 03499"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00070"},{"key":"ref37","article-title":"Adversarial examples detection and analysis with layer-wise autoencoders","author":"w\u00f3jcik","year":"2020","journal-title":"arXiv 2006 10013"},{"key":"ref14","article-title":"Adversarial purification with score-based generative models","author":"yoon","year":"2021","journal-title":"ICML"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref31","article-title":"Voice2series: Reprogramming acoustic models for time series classification","author":"yang","year":"2021","journal-title":"ICML"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00295"},{"key":"ref11","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"arXiv 1802 00420"},{"key":"ref33","article-title":"On the (statistical) detection of adversarial examples","author":"grosse","year":"2017","journal-title":"arXiv 1702 06280"},{"key":"ref10","article-title":"When does contrastive learning preserve adversarial robustness from pretraining to finetuning?","author":"fan","year":"2021","journal-title":"NeurIPS"},{"key":"ref32","article-title":"Why adversarial reprogramming works, when it fails, and how to tell the difference","author":"zheng","year":"2021","journal-title":"arXiv 2108 11673"},{"key":"ref2","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"zhang","year":"2019","journal-title":"ICML"},{"key":"ref1","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2017","journal-title":"arXiv 1706 06083"},{"key":"ref17","article-title":"Denoised smoothing: A provable defense for pretrained classifiers","author":"salman","year":"2020","journal-title":"NeurIPS"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00020"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20545"},{"key":"ref38","article-title":"Proper network interpretability helps adversarial robustness in classification","author":"boopathy","year":"2020","journal-title":"ICML"},{"key":"ref19","article-title":"Stable neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks","author":"kang","year":"2021","journal-title":"NeurIPS"},{"key":"ref18","article-title":"Reverse engineering of imperceptible adversarial image perturbations","author":"gong","year":"2022","journal-title":"arXiv 2203 14145"},{"key":"ref24","article-title":"Fairness reprogramming","author":"zhang","year":"2022","journal-title":"arXiv 2209 10222"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref23","article-title":"Transfer learning without knowing: Re-programming black-box machine learning models with scarce data and limited resources","author":"tsai","year":"2020","journal-title":"arXiv 2007 08714"},{"key":"ref45","article-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","author":"gu","year":"2017","journal-title":"arXiv 1708 06733"},{"key":"ref26","article-title":"Language models are few-shot learners","author":"brown","year":"2020","journal-title":"NeurIPS"},{"key":"ref25","article-title":"Unadversarial examples: Designing objects for robust vision","author":"salman","year":"2021","journal-title":"NeurIPS"},{"key":"ref20","article-title":"Visual prompting: Modifying pixel space to adapt pre-trained models","author":"bahng","year":"2022","journal-title":"arXiv 2203 17274"},{"key":"ref42","article-title":"Online adversarial purification based on self-supervision","author":"shi","year":"2021","journal-title":"arXiv 2101 09387"},{"key":"ref41","article-title":"On fast adversarial robustness adaptation in model-agnostic meta-learning","author":"wang","year":"2021","journal-title":"ICLRE"},{"key":"ref22","article-title":"Adversarial reprogramming of neural networks","author":"elsayed","year":"2018","journal-title":"arXiv 1806 11146"},{"key":"ref44","article-title":"How to robustify black-box ml models? a zeroth-order optimization perspective","author":"zhang","year":"2022","journal-title":"arXiv 2203 14195"},{"key":"ref21","article-title":"Model reprogramming: Resource-efficient cross-domain machine learning","author":"chen","year":"2022"},{"key":"ref43","article-title":"Towards robust neural networks via close-loop control","author":"chen","year":"2021","journal-title":"arXiv 2102 01862"},{"key":"ref28","article-title":"Learning transferable visual models from natural language supervision","author":"radford","year":"2021","journal-title":"ICML"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.acl-long.353"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01421"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref7","article-title":"Certified defenses against adversarial examples","author":"raghunathan","year":"2018","journal-title":"arXiv 1801 09344"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00078"},{"key":"ref4","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","author":"zhang","year":"2019","journal-title":"arXiv 1905 00877"},{"key":"ref3","article-title":"Adversarial training for free!","author":"shafahi","year":"2019","journal-title":"NeurIPS"},{"key":"ref6","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2017","journal-title":"arXiv 1711 00851"},{"key":"ref5","article-title":"Unlabeled data improves adversarial robustness","author":"carmon","year":"2019","journal-title":"NeurIPS"},{"key":"ref40","article-title":"Rethinking randomized smoothing for adversarial robustness","author":"mohapatra","year":"2020","journal-title":"arXiv 2003 01249"}],"event":{"name":"ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","location":"Rhodes Island, Greece","start":{"date-parts":[[2023,6,4]]},"end":{"date-parts":[[2023,6,10]]}},"container-title":["ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10094559\/10094560\/10097245.pdf?arnumber=10097245","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,13]],"date-time":"2023-11-13T13:57:39Z","timestamp":1699883859000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10097245\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,6,4]]},"references-count":46,"URL":"https:\/\/doi.org\/10.1109\/icassp49357.2023.10097245","relation":{},"subject":[],"published":{"date-parts":[[2023,6,4]]}}}