{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:03:20Z","timestamp":1782975800453,"version":"3.54.5"},"reference-count":60,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["ECCS-2216926,CCF-2331302,CNS-2241713,CNS-2339686"],"award-info":[{"award-number":["ECCS-2216926,CCF-2331302,CNS-2241713,CNS-2339686"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00043","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"156-174","source":"Crossref","is-referenced-by-count":0,"title":["Ensemble Conformal Predictor (EnCP): A New Conformal Predictor with Robustness Guarantees Against Data Poisoning Attacks"],"prefix":"10.1109","author":[{"given":"Yuxin","family":"Yang","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology, Jilin University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qiang","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Jilin University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Runyang","family":"Feng","sequence":"additional","affiliation":[{"name":"School of Artificial Intelligence, Jilin University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Liren","family":"Shan","sequence":"additional","affiliation":[{"name":"Toyota Technological Institute at Chicago"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Binghui","family":"Wang","sequence":"additional","affiliation":[{"name":"Illinois Institute of Technology,Department of Computer Science"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-36755-1_29"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/b106715"},{"key":"ref3","article-title":"A tutorial on conformal prediction","volume-title":"Journal of Machine Learning Research","author":"Shafer","year":"2008"},{"key":"ref4","article-title":"A gentle introduction to conformal prediction and distribution-free uncertainty quantification","volume-title":"arXiv","author":"Angelopoulos","year":"2022"},{"key":"ref5","article-title":"Uncertainty sets for image classifiers using conformal prediction","volume-title":"ICLR","author":"Angelopoulos","year":"2021"},{"key":"ref6","article-title":"Learning optimal conformal classifiers","volume-title":"ICLR","author":"Stutz","year":"2022"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1626"},{"key":"ref8","article-title":"Efficient conformal prediction via cascaded inference with expanded admission","volume-title":"ICLR","author":"Fisch","year":"2021"},{"key":"ref9","article-title":"Deep learning for medical image processing: Overview, challenges and the future","author":"Razzak","year":"2017","journal-title":"Classification in BioApps: Automation of decision making"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2350"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.210"},{"key":"ref12","article-title":"Language models with conformal factuality guarantees","volume-title":"ICML","author":"Mohri","year":"2024"},{"key":"ref13","article-title":"Trust or escalate: Llm judges with provable guarantees for human agreement","author":"Jung","year":"2025","journal-title":"ICLR"},{"key":"ref14","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2014","journal-title":"2nd ICLR"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref16","article-title":"Poisoning attacks against support vector machines","author":"Biggio","year":"2012","journal-title":"ICML"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref18","article-title":"Adversarially robust conformal prediction","volume-title":"ICLR","author":"Gendler","year":"2021"},{"key":"ref19","article-title":"Probabilistically robust conformal prediction","volume-title":"UAI","author":"Ghosh","year":"2023"},{"key":"ref20","article-title":"The pitfalls and promise of conformal inference under adversarial attacks","volume-title":"ICML","author":"Liu","year":"2024"},{"key":"ref21","article-title":"Adaptive conformal consensus for provable blockchain oracles","volume-title":"USENIX Security","author":"Park","year":"2023"},{"key":"ref22","article-title":"Data poisoning attacks against conformal prediction","volume-title":"ICML","author":"Li","year":"2024"},{"key":"ref23","article-title":"Provably robust conformal prediction with improved efficiency","volume-title":"ICLR","author":"Yan","year":"2024"},{"key":"ref24","article-title":"Robust yet efficient conformal prediction sets","volume-title":"ICML","author":"Zargarbashi","year":"2024"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0140"},{"key":"ref26","article-title":"Certified adversarial robustness via randomized smoothing","author":"Cohen","year":"2019","journal-title":"ICML"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref28","article-title":"Efficient neural network robustness certification with general activation functions","author":"Zhang","year":"2018","journal-title":"NeurIPS"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1201\/9781003587774"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.2012.751873"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.2017.1395341"},{"key":"ref33","article-title":"Classification with valid and adaptive coverage","author":"Romano","year":"2020","journal-title":"NeurIPS"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1214\/23-AOS2276"},{"key":"ref35","volume-title":"Learning multiple layers of features from tiny images.(2009)","author":"Krizhevsky","year":"2009"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref38","volume-title":"Toxic Comment Classification Challenge Dataset","author":"Jigsaw"},{"key":"ref39","article-title":"Beavertails: Towards improved safety alignment of 11 m via a human-preference dataset","author":"Ji","year":"2023","journal-title":"NeurIPS"},{"key":"ref40","article-title":"Llama guard: Llm-based inputoutput safeguard for human-ai conversations","author":"Inan","year":"2023","journal-title":"arXiv"},{"key":"ref41","article-title":"Provably reliable conformal prediction sets in the presence of data poisoning","volume-title":"ICLR","author":"Scholten","year":"2025"},{"key":"ref42","article-title":"Knowing what you know: valid and validated confidence sets in multiclass and multilabel prediction","volume-title":"Journal of machine learning research","author":"Cauchois","year":"2021"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3478535"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3203"},{"key":"ref45","article-title":"Conformal prediction under covariate shift","volume-title":"NeurIPS","author":"Tibshirani","year":"2019"},{"key":"ref46","article-title":"Adaptive conformal inference under distribution shift","volume-title":"NeurIPS","author":"Gibbs","year":"2021"},{"key":"ref47","article-title":"Adaptive conformal classification with noisy labels","volume-title":"Journal of the Royal Statistical Society Series B: Statistical Methodology","author":"Sesia","year":"2024"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45014-9_1"},{"key":"ref49","article-title":"(de) randomized smoothing for certifiable defense against patch attacks","author":"Levine","year":"2020","journal-title":"NeurIPS"},{"key":"ref50","article-title":"{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and masking","author":"Xiang","year":"2021","journal-title":"USENIX Security"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00053"},{"key":"ref52","article-title":"Deterministic certification of graph neural networks against adversarial perturbations","author":"Xia","year":"2024","journal-title":"ICLR"},{"key":"ref53","article-title":"Provably robust explainable graph neural networks against graph perturbation attacks","author":"Li","year":"2025","journal-title":"ICLR"},{"key":"ref54","article-title":"Agnncert: Defending graph neural networks against arbitrary perturbations with deterministic certification","author":"Li","year":"2025","journal-title":"USENIX Security"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16971"},{"key":"ref56","article-title":"Improved certified defenses against data poisoning with (deterministic) finite aggregation","author":"Wang","year":"2022","journal-title":"ICML"},{"key":"ref57","article-title":"Run-off election: Improved provable defense against data poisoning attacks","author":"Rezaei","year":"2023","journal-title":"ICML"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.00473"},{"key":"ref59","article-title":"Textguard: Provable defense against backdoor attacks on text classification","author":"Pei","year":"2023","journal-title":"NDSS"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690187"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573410.pdf?arnumber=11573410","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:35:40Z","timestamp":1782970540000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573410\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":60,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00043","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}