{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T19:58:37Z","timestamp":1781035117330,"version":"3.54.1"},"reference-count":89,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100006190","name":"Research and Development","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100006190","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100018913","name":"Tsinghua Shenzhen International Graduate School","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100018913","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179383","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T13:18:15Z","timestamp":1689945495000},"page":"1631-1648","source":"Crossref","is-referenced-by-count":17,"title":["StyleFool: Fooling Video Classification Systems via Style Transfer"],"prefix":"10.1109","author":[{"given":"Yuxin","family":"Cao","sequence":"first","affiliation":[{"name":"Tsinghua University,Shenzhen International Graduate School,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xi","family":"Xiao","sequence":"additional","affiliation":[{"name":"Tsinghua University,Shenzhen International Graduate School,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruoxi","family":"Sun","sequence":"additional","affiliation":[{"name":"CSIRO’s Data61,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Derui","family":"Wang","sequence":"additional","affiliation":[{"name":"CSIRO’s Data61,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Minhui","family":"Xue","sequence":"additional","affiliation":[{"name":"CSIRO’s Data61,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sheng","family":"Wen","sequence":"additional","affiliation":[{"name":"Swinburne University of Technology,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","author":"Papernot","year":"2016","journal-title":"Transferability in machine learning: from phenomena to black-box attacks using adversarial samples"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3184558.3186972"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2013.2265531"},{"key":"ref4","volume-title":"Cisco annual internet report (2018-2023) white paper"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3005825"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2872427.2882980"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00032"},{"key":"ref8","volume-title":"Facebook publishing child pornography"},{"key":"ref9","volume-title":"Deepfakes github"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.262"},{"key":"ref11","volume-title":"Deepfake presidents used in Russia-Ukraine war","author":"Wakefield","year":"2022"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00407"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00624"},{"key":"ref14","author":"Jia","year":"2019","journal-title":"Identifying and resisting adversarial videos using temporal consistency"},{"key":"ref15","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proceedings of the 36th International Conference on Machine Learning (ICML)","author":"Cohen"},{"key":"ref16","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Goodfellow"},{"key":"ref17","article-title":"Adversarial training for free!","volume":"32","author":"Shafahi","year":"2019","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23202"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833776"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3343031.3351088"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6918"},{"key":"ref22","first-page":"1097","article-title":"Imagenet classification with deep convolutional neural networks","author":"Krizhevsky","year":"2012","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2012.59"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.502"},{"key":"ref25","first-page":"513","article-title":"Hidden voice commands","volume-title":"Proceedings of 25th USENIX Security Symposium (USENIX Security 16)","author":"Carlini"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489180"},{"key":"ref27","article-title":"Intriguing properties of neural networks","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Szegedy"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref35","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proceedings of the 35th International Conference on Machine Learning (ICML)","author":"Ilyas"},{"key":"ref36","author":"Cheng","year":"2018","journal-title":"Query-efficient hard-label black-box attack: An optimization-based approach"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.330110077"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33018973"},{"key":"ref39","first-page":"2085","article-title":"Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations","volume":"34","author":"Li","year":"2021","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/435"},{"key":"ref41","author":"Chang","year":"2022","journal-title":"Adversarial attacks on deep learning-based video compression and classification systems"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref43","article-title":"Cnngenerated images are surprisingly easy to spot\u2026 for now","volume-title":"Proceedings of the IEEE\/CVF conference on Computer Vision and Pattern Recognition (CVPR)","author":"Wang"},{"key":"ref44","article-title":"Two-stream convolutional networks for action recognition in videos","volume":"27","author":"Simonyan","year":"2014","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.510"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298878"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7299101"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.223"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"ref50","article-title":"Unrestricted adversarial examples via semantic manipulation","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Bhattad"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58574-7_41"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00108"},{"key":"ref54","author":"Brown","year":"2018","journal-title":"Unrestricted adversarial examples"},{"key":"ref55","article-title":"Constructing unrestricted adversarial examples with generative models","volume":"31","author":"Song","year":"2018","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref56","author":"Inkawhich","year":"2018","journal-title":"Adversarial attacks for optical flow-based action recognition classifiers"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00058"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/WACV48630.2021.00324"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3394171.3413531"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/383259.383295"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1167\/16.12.326"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1603.08155"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.745"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-20876-9_40"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45886-1_3"},{"key":"ref66","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Brendel"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/965145.801294"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/965139.807361"},{"key":"ref69","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proceedings of the International Conference on Learning Representations (ICLR)","author":"Simonyan"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/310"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1214\/aos\/1176345632"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref73","author":"Soomro","year":"2012","journal-title":"Ucf101: A dataset of 101 human actions classes from videos in the wild"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2011.6126543"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1016\/0047-259X(82)90077-X"},{"key":"ref77","volume-title":"Amazon mechanical turk"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177730491.MR0022058.Zbl0041.26103"},{"key":"ref79","article-title":"Tight certificates of adversarial robustness for randomly smoothed classifiers","volume":"32","author":"Lee","year":"2019","journal-title":"Advances in Neural Information Processing Systems (NeurIPS)"},{"key":"ref80","first-page":"10 693","article-title":"Randomized smoothing of all shapes and sizes","volume-title":"Proceedings of the 37th International Conference on Machine Learning (ICML)","volume":"119","author":"Yang"},{"key":"ref81","article-title":"Curse of dimensionality on randomized smoothing for certifiable robustness","volume-title":"Proceedings of the International Conference on Machine Learning (ICML)","author":"Kumar"},{"key":"ref82","article-title":"Random smoothing might be unable to certify \u2113\u221e robustness for high-dimensional images","author":"Blum","year":"2020","journal-title":"Journal of Machine Learning Research (JMLR)"},{"key":"ref83","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-319-16178-5_5","article-title":"Classification of artistic styles using binarized features derived from a deep neural network","volume-title":"Proceedings of the European Conference on Computer Vision (ECCV)","author":"Bar"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2017.2710631"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.07.026"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3460426.3463636"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2013.175"},{"key":"ref88","article-title":"A technique for the measurement of attitudes","author":"Likert","year":"1932","journal-title":"Archives of Psychology"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/3173574.3174023"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179383.pdf?arnumber=10179383","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T19:48:23Z","timestamp":1781034503000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179383\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":89,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179383","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}