{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T22:27:05Z","timestamp":1771626425131,"version":"3.50.1"},"reference-count":89,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Culture, Sports and Tourism Research and Development Program"},{"DOI":"10.13039\/501100006465","name":"Korea Creative Content Agency","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100006465","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003561","name":"Ministry of Culture, Sports and Tourism","doi-asserted-by":"publisher","award":["RS-2024-00332210"],"award-info":[{"award-number":["RS-2024-00332210"]}],"id":[{"id":"10.13039\/501100003561","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Biom. Behav. Identity Sci."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tbiom.2025.3644396","type":"journal-article","created":{"date-parts":[[2025,12,15]],"date-time":"2025-12-15T18:40:44Z","timestamp":1765824044000},"page":"255-269","source":"Crossref","is-referenced-by-count":0,"title":["Toward Certifiably Robust Face Recognition: Analyses and Improvements"],"prefix":"10.1109","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1105-1607","authenticated-orcid":false,"given":"Seunghun","family":"Paik","sequence":"first","affiliation":[{"name":"Department of Mathematics and the Research Institute for Natural Sciences, Hanyang University, Seoul, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-4341-873X","authenticated-orcid":false,"given":"Dongsoo","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Mathematics and the Research Institute for Natural Sciences, Hanyang University, Seoul, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-0789-1316","authenticated-orcid":false,"given":"Chanwoo","family":"Hwang","sequence":"additional","affiliation":[{"name":"Department of Mathematics and the Research Institute for Natural Sciences, Hanyang University, Seoul, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7767-4084","authenticated-orcid":false,"given":"Sunpill","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Mathematics and the Research Institute for Natural Sciences, Hanyang University, Seoul, Republic of Korea"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0547-5702","authenticated-orcid":false,"given":"Jae Hong","family":"Seo","sequence":"additional","affiliation":[{"name":"Department of Mathematics and the Research Institute for Natural Sciences, Hanyang University, Seoul, Republic of Korea"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73013-9_9"},{"key":"ref2","article-title":"Intriguing properties of neural networks","volume-title":"Proc. ICLR","author":"Szegedy"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref4","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_4"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1316"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref9","first-page":"1","article-title":"Physical adversarial examples for object detectors","volume-title":"Proc. USENIX WOOT","author":"Eykholt"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00004"},{"key":"ref11","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref12","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. 36th Int. Conf. Mach. Learn. (ICML)","volume":"97","author":"Zhang"},{"key":"ref13","article-title":"Fast is better than free: Revisiting adversarial training","author":"Wong","year":"2020","journal-title":"arXiv:2001.03994"},{"key":"ref14","article-title":"Diffusion models for adversarial purification","author":"Nie","year":"2022","journal-title":"arXiv:2205.07460"},{"key":"ref15","first-page":"12062","article-title":"Adversarial purification with score-based generative models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Yoon"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58577-8_18"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2020.103103"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.12341"},{"key":"ref19","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. ICML","author":"Cohen"},{"key":"ref20","first-page":"19302","article-title":"Provably robust metric learning","volume-title":"Proc. NeurIPS","author":"Wang"},{"key":"ref21","first-page":"35198","article-title":"Improving \u21131-certified robustness via randomized smoothing by leveraging box constraints","volume-title":"Proc. ICML","author":"Voracek"},{"key":"ref22","first-page":"6212","article-title":"Globally-robust neural networks","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Leino"},{"key":"ref23","article-title":"Unlocking deterministic robustness certification on ImageNet","author":"Hu","year":"2023","journal-title":"arXiv:2301.12549"},{"key":"ref24","first-page":"6541","article-title":"Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks","volume-title":"Proc. NeurIPS","volume":"31","author":"Tsuzuku"},{"key":"ref25","first-page":"291","article-title":"Sorting out Lipschitz function approximation","volume-title":"Proc. ICML","author":"Anil"},{"key":"ref26","first-page":"9756","article-title":"Skew orthogonal convolutions","volume-title":"Proc. ICML","author":"Singla"},{"key":"ref27","article-title":"Improved deterministic \u21132 robustness on CIFAR-10 and CIFAR-100","author":"Singla","year":"2021","journal-title":"arXiv:2108.04062"},{"key":"ref28","article-title":"A unified algebraic perspective on Lipschitz neural networks","author":"Araujo","year":"2023","journal-title":"arXiv:2303.03169"},{"key":"ref29","article-title":"RobFR: Benchmarking adversarial robustness on face recognition","author":"Yang","year":"2020","journal-title":"arXiv:2007.04118"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3195384"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW56347.2022.00164"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01819"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1117\/12.2080393"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2016.7477558"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.250"},{"key":"ref37","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00487"},{"key":"ref40","article-title":"Semantic adversarial attacks via diffusion models","author":"Wang","year":"2023","journal-title":"arXiv:2309.07398"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01973"},{"key":"ref42","article-title":"Non-adaptive adversarial face generation","author":"Kim","year":"2025","journal-title":"arXiv:2507.12107"},{"key":"ref43","article-title":"Adversarial patch","author":"Brown","year":"2017","journal-title":"arXiv:1712.09665"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICPR48806.2021.9412236"},{"key":"ref46","article-title":"Towards stable and efficient training of verifiably robust neural networks","author":"Zhang","year":"2019","journal-title":"arXiv:1906.06316"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00019"},{"key":"ref48","article-title":"Adversarial robustness for face recognition: How to introduce ensemble diversity among feature extractors?","volume-title":"Proc. SafeAI@ AAAI","author":"Amada"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01305"},{"key":"ref50","first-page":"12259","article-title":"Theoretical analysis of adversarial learning: A minimax approach","volume-title":"Proc. NeurIPS","volume":"32","author":"Tu"},{"key":"ref51","first-page":"162","article-title":"Improved generalization bounds for robust learning","volume-title":"Proc. 30th Int. Conf. Algorithmic Learn. Theory","volume":"98","author":"Attias"},{"key":"ref52","first-page":"11289","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","volume-title":"Proc. NeurIPS","volume":"32","author":"Salman"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW59228.2023.00037"},{"key":"ref54","first-page":"4910","article-title":"Tight certificates of adversarial robustness for randomly smoothed classifiers","volume-title":"Proc. NeurIPS","volume":"32","author":"Lee"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179303"},{"key":"ref56","first-page":"18904","article-title":"Lot: Layer-wise orthogonal training on improving l2 certified robustness","volume-title":"Proc. NeurIPS","volume":"35","author":"Xu"},{"key":"ref57","first-page":"15484","article-title":"A dynamical system perspective for Lipschitz neural networks","volume-title":"Proc. ICML","author":"Meunier"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19803-8_21"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2016.7533046"},{"key":"ref60","article-title":"Spectral normalization for generative adversarial networks","author":"Miyato","year":"2018","journal-title":"arXiv:1802.05957"},{"key":"ref61","article-title":"Spectral norm regularization for improving the generalizability of deep learning","author":"Yoshida","year":"2017","journal-title":"arXiv:1705.10941"},{"key":"ref62","first-page":"42993","article-title":"Unlocking deterministic robustness certification on ImageNet","volume-title":"Proc. NeurIPS","author":"Hu"},{"key":"ref63","article-title":"LipSim: A provably robust perceptual similarity metric","author":"Ghazanfari","year":"2023","journal-title":"arXiv:2310.18274"},{"key":"ref64","article-title":"1-Lipschitz neural networks are more expressive with N-activations","author":"Prach","year":"2023","journal-title":"arXiv:2311.06103"},{"key":"ref65","first-page":"20077","article-title":"Pay attention to your loss: Understanding misconceptions about Lipschitz neural networks","volume-title":"Proc. NeurIPS","volume":"35","author":"B\u00e9thune"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00057"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02320"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.713"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00594"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01400"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00552"},{"key":"ref73","first-page":"5019","article-title":"Adversarially robust generalization requires more data","volume-title":"Proc. NeurIPS","author":"Schmidt"},{"key":"ref74","article-title":"Intriguing properties of robust classification","author":"Prach","year":"2024","journal-title":"arXiv:2412.04245"},{"key":"ref75","first-page":"1129","article-title":"Automatic perturbation analysis for scalable certified robustness and beyond","volume-title":"Proc. NeurIPS","author":"Xu"},{"key":"ref76","first-page":"8026","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Proc. NeurIPS","volume":"32","author":"Paszke"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00525"},{"key":"ref78","article-title":"Adam: A method for stochastic optimization","author":"Kingma","year":"2014","journal-title":"arXiv:1412.6980"},{"key":"ref79","volume-title":"Insightface: 2D and 3D face analysis project","author":"Guo","year":"2025"},{"key":"ref80","volume-title":"Torchvision: PyTorch\u2019s Computer Vision Library","year":"2016"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01108"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/TEVC.2019.2890858"},{"key":"ref84","article-title":"Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates","author":"Ghiasi","year":"2020","journal-title":"arXiv:2003.08937"},{"key":"ref85","first-page":"19398","article-title":"Rethinking Lipschitz neural networks and certified robustness: A Boolean function perspective","volume-title":"Proc. NeurIPS","author":"Zhang"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72913-3_14"},{"key":"ref87","article-title":"Vec2Face: Scaling face dataset generation with loosely constrained vectors","author":"Wu","year":"2024","journal-title":"arXiv:2409.02979"},{"key":"ref88","article-title":"A recipe for improved certifiable robustness","author":"Hu","year":"2023","journal-title":"arXiv:2310.02513"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3247"}],"container-title":["IEEE Transactions on Biometrics, Behavior, and Identity Science"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8423754\/11400646\/11300837.pdf?arnumber=11300837","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,20]],"date-time":"2026-02-20T21:19:46Z","timestamp":1771622386000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11300837\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":89,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tbiom.2025.3644396","relation":{},"ISSN":["2637-6407"],"issn-type":[{"value":"2637-6407","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}