{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T02:10:52Z","timestamp":1769911852195,"version":"3.49.0"},"reference-count":91,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833776","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"1390-1407","source":"Crossref","is-referenced-by-count":15,"title":["Universal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems"],"prefix":"10.1109","author":[{"given":"Shangyu","family":"Xie","sequence":"first","affiliation":[{"name":"Illinois Institute of Technology,Chicago,IL,60616"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Han","family":"Wang","sequence":"additional","affiliation":[{"name":"Illinois Institute of Technology,Chicago,IL,60616"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Kong","sequence":"additional","affiliation":[{"name":"Rochester Institute of Technology,Rochester,NY,14623"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuan","family":"Hong","sequence":"additional","affiliation":[{"name":"Illinois Institute of Technology,Chicago,IL,60616"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/325165.325247"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15561-1_11"},{"key":"ref15","article-title":"Improving black-box adversarial attacks with a transfer-based prior","author":"cheng","year":"2019","journal-title":"NeurIPS"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/566654.566636"},{"key":"ref14","article-title":"Query-efficient hard-label black-box attack: An optimization-based approach","author":"cheng","year":"2019","journal-title":"ICLRE"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/2899007.2899008"},{"key":"ref52","first-page":"739","article-title":"Off-road obstacle avoidance through end-to-end learning","author":"muller","year":"2006","journal-title":"NeurIPS"},{"key":"ref55","article-title":"Mixup inference: Better exploiting mixup to defend adversarial attacks","author":"pang","year":"2020","journal-title":"ICLRE"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00004"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2019.8852322"},{"key":"ref10","article-title":"Deep learning for anomaly detection: A survey","author":"chalapathy","year":"2019","journal-title":"arXiv preprint arXiv 1901 03912"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3345660"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/4235.985692"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2995289.2995290"},{"key":"ref18","article-title":"Certified adversarial robustness via randomized smoothing","author":"cohen","year":"2019","journal-title":"ICML"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref91","author":"zhou","year":"2018","journal-title":"Invisible mask Practical attacks on face recognition with infrared"},{"key":"ref90","first-page":"3320","article-title":"How transferable are features in deep neural networks?","author":"yosinski","year":"2014","journal-title":"NeurIPS"},{"key":"ref46","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"liu","year":"2017","journal-title":"ICLRE"},{"key":"ref89","article-title":"Adversarial example detection and classification with asymmetrical adversarial training","author":"yin","year":"2020","journal-title":"ICLRE"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref47","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"ICLRE"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23138"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00407"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.554"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423348"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23202"},{"key":"ref49","first-page":"461","article-title":"Ct-gan: Malicious tampering of 3d medical imagery using deep learning","author":"mirsky","year":"2019","journal-title":"Usenix Security"},{"key":"ref8","author":"carlini","year":"2017","journal-title":"Magnet and “efficient defenses against adversarial attacks” are not robust to adversarial examples"},{"key":"ref7","first-page":"513","article-title":"Hidden voice commands","author":"carlini","year":"2016","journal-title":"USENIX SEC'16"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.502"},{"key":"ref4","first-page":"1","article-title":"Random smoothing might be unable to certify ?? robustness for high-dimensional images","volume":"21","author":"blum","year":"2020","journal-title":"JMLR"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref5","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"brendel","year":"2018","journal-title":"ICLRE"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33018973"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2020-0073"},{"key":"ref84","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","author":"wong","year":"2018","journal-title":"ICML"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1531326.1531360"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6918"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-015-7744-1_2"},{"key":"ref79","author":"van den bergh","year":"2007","journal-title":"An analysis of particle swarm optimizers"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICETET.2010.177"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00675"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.223"},{"key":"ref37","first-page":"5458","article-title":"Curse of dimensionality on randomized smoothing for certifiable robustness","author":"kumar","year":"2020","journal-title":"ICML"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2011.6126543"},{"key":"ref75","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram`er","year":"2018","journal-title":"ICLRE"},{"key":"ref31","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","author":"ilyas","year":"2018","journal-title":"ICML"},{"key":"ref74","article-title":"On adaptive attacks to adversarial example defenses","author":"tramer","year":"2020","journal-title":"NeurIPS"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.179"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00565"},{"key":"ref33","doi-asserted-by":"crossref","DOI":"10.3390\/s20174806","article-title":"The security of ip-based video surveillance systems","volume":"20","author":"kalbo","year":"2020","journal-title":"SENSORS"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.510"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3343031.3351088"},{"key":"ref2","article-title":"On the robustness of the cvpr 2018 white-box adversarial example defenses","author":"athalye","year":"2018","journal-title":"arXiv 1804 03286"},{"key":"ref1","year":"2020","journal-title":"Ffmpeg guide"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1111\/j.1467-8659.2010.01827.x"},{"key":"ref38","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2016","journal-title":"arXiv preprint arXiv 1607 02533"},{"key":"ref71","first-page":"1327","article-title":"Hybrid batch attacks: Finding black-box adversarial examples with limited queries","author":"suya","year":"2020","journal-title":"Usenix Security"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412165"},{"key":"ref73","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"ICLRE"},{"key":"ref72","first-page":"392","article-title":"Modeling color difference for visualization design","volume":"24","author":"szafir","year":"2017","journal-title":"IEEE TVCG"},{"key":"ref68","year":"2016","journal-title":"Shodan report"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1049\/ji-3-2.1946.0074"},{"key":"ref67","author":"srivastava","year":"2016","journal-title":"Surveillance cameras sold on Amazon infected with malware"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.213"},{"key":"ref26","author":"goldberg","year":"1988","journal-title":"Genetic Algorithms and Machine Learning"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00678"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1287\/ijoc.1.3.190"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3351261"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298878"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.6017"},{"key":"ref66","article-title":"UCF101: A dataset of 101 human actions classes from videos in the wild","volume":"abs 1212 402","author":"soomro","year":"2012","journal-title":"CoRR"},{"key":"ref22","first-page":"405","article-title":"Particle swarm model selection","volume":"10","author":"escalante","year":"2009","journal-title":"JMLR"},{"key":"ref65","first-page":"568","article-title":"Two-stream convolutional networks for action recognition in videos","author":"simonyan","year":"2014","journal-title":"NeurIPS"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/MHS.1995.494215"},{"key":"ref28","article-title":"Adversarial perturbations against deep neural networks for malware classification","author":"grosse","year":"2016","journal-title":"arXiv preprint arXiv 1606 04435"},{"key":"ref27","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"ICLRE"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.2514\/6.2005-1897"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.23919\/ACC.2017.7963716"},{"key":"ref62","article-title":"Adversarial training for free!","author":"shafahi","year":"2019","journal-title":"NeurIPS"},{"key":"ref61","first-page":"5498","article-title":"The odds are odd: A statistical test for detecting adversarial examples","author":"roth","year":"2019","journal-title":"ICML"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833776.pdf?arnumber=9833776","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:04:16Z","timestamp":1699484656000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833776\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":91,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833776","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}