{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,2]],"date-time":"2026-08-02T22:06:52Z","timestamp":1785708412391,"version":"3.56.0"},"reference-count":99,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179473","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"701-718","source":"Crossref","is-referenced-by-count":14,"title":["AI-Guardian: Defeating Adversarial Attacks using Backdoors"],"prefix":"10.1109","author":[{"given":"Hong","family":"Zhu","sequence":"first","affiliation":[{"name":"Chinese Academy of Sciences,SKLOIS, Institute of Information Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shengzhi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Boston University,Metropolitan College,USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kai","family":"Chen","sequence":"additional","affiliation":[{"name":"Chinese Academy of Sciences,SKLOIS, Institute of Information Engineering,China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"CFPB consumer complaint database"},{"key":"ref2","article-title":"Open source computer vision library"},{"key":"ref3","article-title":"Pannous speech recognition"},{"key":"ref4","article-title":"San francisco crime classification"},{"key":"ref5","article-title":"Speech recognition with the caffe deep learning framework"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2014.2339736"},{"issue":"2","key":"ref7","first-page":"150","article-title":"Artificial neural networks in medical diagnosis","volume":"8","author":"Al-Shayea","year":"2011","journal-title":"International Journal of Computer Science Issues"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485899"},{"key":"ref9","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Athalye"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833677"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2019.03.001"},{"key":"ref12","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Brendel"},{"key":"ref13","article-title":"Adversarial patch","author":"Brown","year":"2017","journal-title":"CoRR"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00387"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref16","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence Workshop","author":"Chen"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/647"},{"key":"ref18","article-title":"Hop-SkipJumpAttack open source implementation","author":"Chen"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/sp40000.2020.00045"},{"key":"ref20","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-030-10925-7_4","article-title":"Shapeshifter: Robust physical adversarial attack on faster R-CNN object detector","volume-title":"Proceedings of the Machine Learning and Knowledge Discovery in Databases - European Conference","author":"Chen"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3385003.3410925"},{"key":"ref22","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"CoRR"},{"key":"ref23","article-title":"Devil\u2019s whisper: A general approach for physical adversarial attacks against commercial black-box speech recognition devices","volume-title":"Proceedings of USENIX Security Symposium","author":"Chen"},{"key":"ref24","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Croce"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2019.8793868"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.58"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2021.3124365"},{"key":"ref28","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression","author":"Das","year":"2017","journal-title":"CoRR"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3559388"},{"key":"ref30","article-title":"A study of the effect of JPG compression on adversarial images","author":"Dziugaite","year":"2016","journal-title":"CoRR"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-2006"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref35","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Goodfellow"},{"key":"ref36","article-title":"Towards deep neural network architectures robust to adversarial examples","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Gu"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2019.07.052"},{"key":"ref39","article-title":"Countering adversarial images using input transformations","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Guo"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM50108.2020.00025"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485378"},{"key":"ref42","article-title":"DISCO: Adversarial defense with local implicit functions","author":"Ho","year":"2022","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSC.2019.00050"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/4830411"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485904"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/d14-1181"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1406.3269"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8462693"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref51","first-page":"276","article-title":"Learning algorithms for classification: A comparison on handwritten digit recognition","volume":"261","author":"LeCun","year":"1995","journal-title":"Neural networks: the statistical mechanics perspective"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/ITME.2018.00199"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICSS53362.2021.00023"},{"key":"ref54","article-title":"Blacklight: Scalable defense for neural networks against query-based black-box attacks","volume-title":"Proceedings of the 31st USENIX Security Symposium","author":"Li"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ASRU46091.2019.9003763"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"ref60","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Ma"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2896880"},{"key":"ref64","article-title":"Adversarial robustness toolbox v1.2.0","author":"Nicolae","year":"2018","journal-title":"CoRR"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"ref68","article-title":"Defense-gan: Protecting classifiers against adversarial attacks using generative models","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Samangouei"},{"key":"ref69","article-title":"Trapdoor open source implementation","author":"Shan"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417231"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICSESS49938.2020.9237690"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103101"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.neunet.2012.02.016"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref76","article-title":"THUCTC: An efficient chinese text classifier","author":"Sun","year":"2016"},{"key":"ref77","article-title":"Model-targeted poisoning attacks with provable convergence","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Suya"},{"key":"ref78","article-title":"Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection","volume-title":"Proceedings of the USENIX Security Symposium","author":"Tang"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403064"},{"key":"ref80","volume-title":"San francisco crime classification","author":"Ting","year":"2015"},{"key":"ref81","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Tram\u00e8r"},{"key":"ref82","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proceedings of the Annual Conference on Neural Information Processing Systems","author":"Tran"},{"key":"ref83","article-title":"Fran\u00e7ois Boulogne, Joshua D. Warner, Neil Yager, Emmanuelle Gouillart, and Tony Yu. scikit-image: Image processing in python","author":"van der Walt","year":"2014","journal-title":"CoRR"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/WACV51458.2022.00392"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2011.5995566"},{"key":"ref88","article-title":"Fast is better than free open source implementation","author":"Wong"},{"key":"ref89","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Wong"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/1982\/1\/012047"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00034"},{"key":"ref93","article-title":"Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A. Gunter. Commandersong: A systematic approach for practical adversarial voice recognition","volume-title":"Proceedings of USENIX Security Symposium","author":"Yuan"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/1757\/1\/012092"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00033"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01445"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484818"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354259"},{"key":"ref99","article-title":"Transferable clean-label poisoning attacks on deep neural nets","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Zhu"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179473.pdf?arnumber=10179473","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:16:56Z","timestamp":1721452616000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179473\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":99,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179473","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}