{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T22:11:58Z","timestamp":1772489518700,"version":"3.50.1"},"reference-count":50,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"NSFC-ISF Joint Program","award":["62161146001"],"award-info":[{"award-number":["62161146001"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Artif. Intell."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tai.2025.3602931","type":"journal-article","created":{"date-parts":[[2025,8,27]],"date-time":"2025-08-27T18:34:04Z","timestamp":1756319644000},"page":"1574-1583","source":"Crossref","is-referenced-by-count":0,"title":["Certified Local Transferability for Evaluating Adversarial Attacks"],"prefix":"10.1109","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-3406-7520","authenticated-orcid":false,"given":"Minyu","family":"Chen","sequence":"first","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3707-4623","authenticated-orcid":false,"given":"Jingyang","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8259-2200","authenticated-orcid":false,"given":"Ling-I","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9005-7112","authenticated-orcid":false,"given":"Guoqiang","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5729"},{"key":"ref2","first-page":"370","article-title":"Lagrangian decomposition for neural network verification","volume-title":"Proc. Conf. Uncertainty Artif. Intell.","author":"Bunel","year":"2020"},{"key":"ref3","first-page":"4795","article-title":"A unified view of piecewise linear neural network verification","volume":"31","author":"Bunel","year":"2018","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref5","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Cohen","year":"2019"},{"key":"ref6","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Croce","year":"2020"},{"key":"ref7","first-page":"5318","article-title":"Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming","volume":"33","author":"Dathathri","year":"2020","journal-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)"},{"key":"ref8","article-title":"Improved branch and bound for neural network verification via Lagrangian decomposition","author":"Palma","year":"2021"},{"key":"ref9","article-title":"Provably robust adversarial examples","author":"Dimitrov","year":"2020"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-77935-5_9"},{"key":"ref12","first-page":"550","article-title":"A dual approach to scalable verification deep networks","volume-title":"Proc. Conf. Uncertainty Artif. Intell.","author":"Dvijotham","year":"2018"},{"key":"ref13","first-page":"269","article-title":"Formal verification of piece-wise linear feed-forward neural networks","volume-title":"Proc. Int. Symp. Automat. Technol. Verification Anal. (ATVA)","year":"2017"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1126\/science.aaw4399"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/649"},{"key":"ref17","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00068"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-24950-1_10"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref22","article-title":"Torchattacks: A PyTorch repository for adversarial attacks","author":"Kim","year":"2020"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref24","first-page":"16891","article-title":"Lipschitz-certifiable training with a tight outer bound","volume":"33","author":"Lee","year":"2020","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3116105"},{"key":"ref26","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","author":"Lin","year":"2019"},{"key":"ref27","first-page":"4072","article-title":"On certifying non-uniform bounds against adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Liu","year":"2019"},{"key":"ref28","article-title":"Neural network branching for neural network verification","author":"Lu","year":"2019"},{"key":"ref29","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref32","first-page":"7650","article-title":"Random noise defense against query-based black-box attacks","volume":"34","author":"Qin","year":"2021","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref33","first-page":"10900","article-title":"Semidefinite relaxations for certifying robustness to adversarial examples","volume":"31","author":"Raghunathan","year":"2018","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref34","first-page":"11292","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","volume":"32","author":"Salman","year":"2019","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3290354"},{"key":"ref36","article-title":"Evaluating robustness of neural networks with mixed integer programming","author":"Tjeng","year":"2017"},{"key":"ref37","first-page":"1894","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. 6th Int. Conf. Learn. Represent.","author":"Tram\u00e8r","year":"2018"},{"key":"ref38","first-page":"29909","article-title":"Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification","volume":"34","author":"Wang","year":"2021","journal-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01585"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01182"},{"key":"ref41","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wong","year":"2018"},{"key":"ref42","first-page":"5849","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wong","year":"2020"},{"key":"ref43","first-page":"8410","article-title":"Scaling provable adversarial defenses","volume":"31","author":"Wong","year":"2018","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598127"},{"key":"ref46","first-page":"8416","article-title":"Towards robustness certification against universal perturbations","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Zeng","year":"2023"},{"key":"ref47","first-page":"19398","article-title":"Rethinking lipschitz neural networks and certified robustness: A Boolean function perspective","volume":"35","author":"Zhang","year":"2022","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref48","first-page":"1656","article-title":"General cutting planes for bound-propagation-based neural network verification","volume":"35","author":"Zhang","year":"2022","journal-title":"Proc. Adv. Neural Inf. Process. Syst."},{"key":"ref49","first-page":"31","article-title":"Efficient neural network robustness certification with general activation functions","author":"Zhang","year":"2018","journal-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00790"}],"container-title":["IEEE Transactions on Artificial Intelligence"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/9078688\/11417361\/11142670.pdf?arnumber=11142670","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,2]],"date-time":"2026-03-02T20:58:57Z","timestamp":1772485137000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11142670\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":50,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tai.2025.3602931","relation":{},"ISSN":["2691-4581"],"issn-type":[{"value":"2691-4581","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}