{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,13]],"date-time":"2026-10-13T17:02:06Z","timestamp":1791910926594,"version":"4.3.4"},"reference-count":60,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62471420"],"award-info":[{"award-number":["62471420"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100021171","name":"GuangDong Basic and Applied Basic Research Foundation","doi-asserted-by":"publisher","award":["2025A15150122 96"],"award-info":[{"award-number":["2025A15150122 96"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.00446","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"4691-4700","source":"Crossref","is-referenced-by-count":2,"title":["Failure Cases Are Better Learned but Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training"],"prefix":"10.1109","author":[{"given":"Yanyun","family":"Wang","sequence":"first","affiliation":[{"name":"The Hong Kong University of Science and Technology,Guangzhou"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Liu","sequence":"additional","affiliation":[{"name":"The Hong Kong University of Science and Technology,Guangzhou"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Estimating neural network robustness via lipschitz constant and architecture sensitivity","author":"Abuduweili","year":"2024","journal-title":"Safe and Robust Robot Learning for Operation in the Real World Workshop @ CoRL"},{"key":"ref2","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"Athalye","year":"2018","journal-title":"ICML"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/591"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref5","article-title":"Robust overfitting may be mitigated by properly learned smoothening","author":"Chen","year":"2021","journal-title":"ICLR"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/95"},{"key":"ref7","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","author":"Croce","year":"2020","journal-title":"ICML"},{"key":"ref8","article-title":"Mma training: Direct input space margin maximization through adversarial training","author":"Weiguang Ding","year":"2020","journal-title":"ICLR"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref10","article-title":"Exploring memorization in adversarial training","author":"Dong","year":"2022","journal-title":"ICLR"},{"key":"ref11","article-title":"Certified robustness via dynamic margin maximization and improved lipschitz regularization","author":"Fazlyab","year":"2023","journal-title":"NeurIPS"},{"key":"ref12","article-title":"Explaining and harnessing adversarial examples","author":"Ian","year":"2015","journal-title":"ICLR"},{"key":"ref13","article-title":"Conserve-update-revise to cure generalization and robustness trade-off in adversarial training","author":"Gowda","year":"2024","journal-title":"ICLR"},{"key":"ref14","article-title":"Countering adversarial images using input transformations","author":"Guo","year":"2018","journal-title":"ICLR"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2020.100270"},{"key":"ref18","article-title":"Averaging weights leads to wider optima and better generalization","author":"Izmailov","year":"2018","journal-title":"UAI"},{"key":"ref19","article-title":"One-vs-the-rest loss to focus on important samples in adversarial training","author":"Kanai","year":"2023","journal-title":"ICML"},{"key":"ref20","article-title":"Entropy weighted adversarial training","author":"Kim","year":"2021","journal-title":"Adversarial Machine Learning Workshop @ ICML"},{"key":"ref21","article-title":"Lipschitz bounds and provably robust training by laplacian smoothing","author":"Krishnan","year":"2020","journal-title":"NeurIPS"},{"key":"ref22","author":"Krizhevsky","year":"2009","journal-title":"Learning multiple layers of features from tiny images"},{"key":"ref23","author":"Li","year":"2015","journal-title":"Tiny imagenet dataset"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i18.29964"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref26","author":"Lin","year":"2025","journal-title":"Backdoordm: A comprehensive benchmark for backdoor learning in diffusion model"},{"key":"ref27","article-title":"Probabilistic margins for instance reweighting in adversarial training","author":"Liu","year":"2021","journal-title":"NeurIPS"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3533925"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref30","article-title":"Spectral normalization for generative adversarial networks","author":"Miyato","year":"2018","journal-title":"ICLR"},{"key":"ref31","article-title":"Bag of tricks for adversarial training","author":"Pang","year":"2021","journal-title":"ICLR"},{"key":"ref32","article-title":"Practi-cal black-box attacks against machine learning","author":"Papernot","year":"2017","journal-title":"AsiaCCS"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/LCSYS.2021.3050444"},{"key":"ref34","article-title":"Reducing excessive margin to achieve a better accuracy vs. robustness trade-off","author":"Rade","year":"2022","journal-title":"ICLR"},{"key":"ref35","article-title":"Adversarial training can hurt generalization","author":"Raghunathan","year":"2019","journal-title":"Identifying and Understanding Deep Learning Phenomena Workshop @ ICML"},{"key":"ref36","article-title":"Understanding and mitigating the tradeoff between robustness and accuracy","author":"Raghunathan","year":"2020","journal-title":"ICML"},{"key":"ref37","article-title":"Data augmentation can improve robustness","author":"Rebuffi","year":"2021","journal-title":"NeurIPS"},{"key":"ref38","article-title":"Confidencecalibrated adversarial training: Generalizing to unseen attacks","author":"Stutz","year":"2020","journal-title":"ICML"},{"key":"ref39","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014","journal-title":"ICLR"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i8.20817"},{"key":"ref41","article-title":"Better safe than sorry: Preventing delusive adversaries with adversarial training","author":"Tao","year":"2021","journal-title":"NeurIPS"},{"key":"ref42","article-title":"On adaptive attacks to adversarial example defenses","author":"Tramer","year":"2020","journal-title":"NeurIPS"},{"key":"ref43","article-title":"Robustness may be at odds with accuracy","author":"Tsipras","year":"2019","journal-title":"ICLR"},{"key":"ref44","article-title":"Once-for-all adversarial training: In-situ tradeoff between robustness and accuracy for free","author":"Wang","year":"2020","journal-title":"NeurIPS"},{"key":"ref45","article-title":"Improving adversarial robustness requires revisiting misclassified examples","author":"Wang","year":"2020","journal-title":"ICLR"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.3233\/faia240644"},{"key":"ref47","article-title":"Balance, imbalance, and rebalance: Understanding robust overfitting from a minimax game perspective","author":"Wang","year":"2023","journal-title":"NeurIPS"},{"key":"ref48","author":"Wang","year":"2024","journal-title":"New paradigm of adversarial training: Releasing accuracy-robustness trade-off via dummy class"},{"key":"ref49","article-title":"Adversarial weight perturbation helps robust generalization","author":"Wu","year":"2020","journal-title":"NeurIPS"},{"key":"ref50","article-title":"Annealing self-distillation rectification improves adversarial training","author":"Wu","year":"2024","journal-title":"ICLR"},{"key":"ref51","article-title":"Mitigating adversarial effects through randomization","author":"Xie","year":"2018","journal-title":"ICLR"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref53","article-title":"One size does not fit all: Dataadaptive adversarial training","author":"Yang","year":"2022","journal-title":"ECCV"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3263637"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00612"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-30164-8_251"},{"key":"ref58","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"Zhang","year":"2019","journal-title":"ICML"},{"key":"ref59","article-title":"Geometry-aware instance-reweighted adversarial training","author":"Zhang","year":"2021","journal-title":"ICLR"},{"key":"ref60","article-title":"Sdformer: Transformer with spectral filter and dynamic attention for multivariate time series longterm forecasting","author":"Zhou","year":"2024","journal-title":"IJCAI"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11444296.pdf?arnumber=11444296","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T04:50:08Z","timestamp":1777611008000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11444296\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":60,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.00446","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}