{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,2]],"date-time":"2026-02-02T19:58:19Z","timestamp":1770062299018,"version":"3.49.0"},"reference-count":59,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"5","license":[{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,10,1]],"date-time":"2023-10-01T00:00:00Z","timestamp":1696118400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62002334"],"award-info":[{"award-number":["62002334"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62072421"],"award-info":[{"award-number":["62072421"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62121002"],"award-info":[{"award-number":["62121002"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Anhui Science Foundation of China","award":["2008085QF296"],"award-info":[{"award-number":["2008085QF296"]}]},{"name":"Anhui Initiative in Quantum Information Technologies","award":["AHY150400"],"award-info":[{"award-number":["AHY150400"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Artif. Intell."],"published-print":{"date-parts":[[2023,10]]},"DOI":"10.1109\/tai.2022.3190816","type":"journal-article","created":{"date-parts":[[2022,7,14]],"date-time":"2022-07-14T15:43:10Z","timestamp":1657813390000},"page":"1029-1040","source":"Crossref","is-referenced-by-count":9,"title":["Feature Fusion Based Adversarial Example Detection Against Second-Round Adversarial Attacks"],"prefix":"10.1109","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5841-8210","authenticated-orcid":false,"given":"Chuan","family":"Qin","sequence":"first","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuefeng","family":"Chen","sequence":"additional","affiliation":[{"name":"Alibaba Group, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9868-3414","authenticated-orcid":false,"given":"Kejiang","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4654-835X","authenticated-orcid":false,"given":"Xiaoyi","family":"Dong","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5576-6108","authenticated-orcid":false,"given":"Weiming","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaofeng","family":"Mao","sequence":"additional","affiliation":[{"name":"Alibaba Group, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6885-1341","authenticated-orcid":false,"given":"Yuan","family":"He","sequence":"additional","affiliation":[{"name":"Alibaba Group, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4417-9316","authenticated-orcid":false,"given":"Nenghai","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, University of Science and Technology of China, Key Laboratory of Electromagnetic Space Information, Chinese Academy of Sciences, Hefei, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref56","article-title":"Adam: A method for stochastic optimization","author":"kingma","year":"0","journal-title":"Proc 3rd Int Conf Learn Representations"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref58","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"0","journal-title":"Proc 6th Int Conf Learn Representations"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2134094"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2014.7084325"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref55","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref10","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"0","journal-title":"Proc 6th Int Conf Learn Representations"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00745"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00482"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00930"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref18","article-title":"Ensemble adversarial training: Attacks and defenses","author":"tram\u00e8r","year":"0","journal-title":"Proc 6th Int Conf Learn Representations"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2175919"},{"key":"ref50","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume":"80","author":"athalye","year":"0","journal-title":"Proc 35th Int Conf Mach Learn"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2871749"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2710946"},{"key":"ref48","first-page":"1150","volume":"25","author":"duda","year":"2001","journal-title":"Stork Pattern Classification"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2936913"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2012.2190402"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2019.107422"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3005304"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2013.12.001"},{"key":"ref8","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"0","journal-title":"Proc 3rd Int Conf Learn Representations"},{"key":"ref7","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"0","journal-title":"Proc 2nd Int Conf Learn Representations"},{"key":"ref9","article-title":"Adversarial machine learning at scale","author":"kurakin","year":"0","journal-title":"Proc 5th Int Conf Learn Representations"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.81"},{"key":"ref3","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"0","journal-title":"Proc 3rd Int Conf Learn Representations"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2016.2577031"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.169"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00496"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref34","article-title":"On detecting adversarial perturbations","author":"metzen","year":"0","journal-title":"Proc 5th Int Conf Learn Representations"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2021.108048"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2019.107343"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2018.2874243"},{"key":"ref33","article-title":"Adversarial and clean data are not twins","author":"gong","year":"2017"},{"key":"ref32","article-title":"On the (statistical) detection of adversarial examples","author":"grosse","year":"2017"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref1","article-title":"One weird trick for parallelizing convolutional neural networks","author":"krizhevsky","year":"2014"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2891237"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00015-8_23"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref26","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","author":"ma","year":"0","journal-title":"Proc 6th Int Conf Learn Representations"},{"key":"ref25","article-title":"Early methods for detecting adversarial images","author":"hendrycks","year":"0","journal-title":"Proc 5th Int Conf Learn Representations"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref22","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression","author":"das","year":"2017"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CISS.2018.8362326"},{"key":"ref28","article-title":"A baseline for detecting misclassified and out-of-distribution examples in neural networks","author":"hendrycks","year":"0","journal-title":"Proc 5th Int Conf Learn Representations"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.173"},{"key":"ref29","first-page":"7167","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","author":"lee","year":"0","journal-title":"Proc Adv Neural Inf Process Syst"}],"container-title":["IEEE Transactions on Artificial Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9078688\/10261321\/09829929.pdf?arnumber=9829929","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T01:08:37Z","timestamp":1755911317000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9829929\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10]]},"references-count":59,"journal-issue":{"issue":"5"},"URL":"https:\/\/doi.org\/10.1109\/tai.2022.3190816","relation":{},"ISSN":["2691-4581"],"issn-type":[{"value":"2691-4581","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10]]}}}