{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T22:42:26Z","timestamp":1780612946518,"version":"3.54.1"},"reference-count":106,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T00:00:00Z","timestamp":1727740800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T00:00:00Z","timestamp":1727740800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,10,1]],"date-time":"2024-10-01T00:00:00Z","timestamp":1727740800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272459"],"award-info":[{"award-number":["62272459"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62125208"],"award-info":[{"award-number":["62125208"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"Strategic Priority Research Program of Chinese Academy of Sciences","doi-asserted-by":"publisher","award":["XDB0690000"],"award-info":[{"award-number":["XDB0690000"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst."],"published-print":{"date-parts":[[2024,10]]},"DOI":"10.1109\/tcad.2024.3390031","type":"journal-article","created":{"date-parts":[[2024,4,16]],"date-time":"2024-04-16T17:21:14Z","timestamp":1713288074000},"page":"3088-3101","source":"Crossref","is-referenced-by-count":4,"title":["EnsGuard: A Novel Acceleration Framework for Adversarial Ensemble Learning"],"prefix":"10.1109","volume":"43","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5295-7483","authenticated-orcid":false,"given":"Xingbin","family":"Wang","sequence":"first","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2485-0899","authenticated-orcid":false,"given":"Yan","family":"Wang","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7539-7132","authenticated-orcid":false,"given":"Yulan","family":"Su","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3746-8083","authenticated-orcid":false,"given":"Sisi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dan","family":"Meng","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9215-7632","authenticated-orcid":false,"given":"Rui","family":"Hou","sequence":"additional","affiliation":[{"name":"Key Laboratory of Cyberspace Security Defense, Institute of Information Engineering, CAS, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Enhance transferability of adversarial examples with model architecture","author":"Fan","year":"2022","journal-title":"arXiv:2202.13625"},{"key":"ref2","article-title":"Robust textual embedding against word-level adversarial attacks","author":"Yang","year":"2022","journal-title":"arXiv:2202.13817"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3475724.3483606"},{"key":"ref4","first-page":"1","article-title":"Certified defenses against adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Raghunathan"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref6","article-title":"Adversarial feature genome: A data driven adversarial examples recognition method","author":"Chen","year":"2018","journal-title":"arXiv:1812.10085"},{"key":"ref7","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref8","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref9","first-page":"2137","article-title":"Black-box adversarial attacks with limited queries and information","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilyas"},{"key":"ref10","article-title":"Improving adversarial robustness of ensembles with diversity training","author":"Kariyappa","year":"2019","journal-title":"arXiv:1901.09981"},{"key":"ref11","first-page":"1","article-title":"Adversarial robustness for face recognition: How to introduce ensemble diversity among feature extractors?","volume-title":"Proc. SafeAI@ AAAI","author":"Amada"},{"key":"ref12","article-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1705.07204"},{"key":"ref13","article-title":"Voting based ensemble improves robustness of defensive models","author":"Cheng","year":"2020","journal-title":"arXiv:2011.14031"},{"key":"ref14","article-title":"Ensemble-in-one: Learning ensemble within random gated networks for enhanced adversarial robustness","author":"Cai","year":"2021","journal-title":"arXiv:2103.14795"},{"key":"ref15","article-title":"Ensembles of many diverse weak defenses can be strong: Defending deep neural networks against adversarial attacks","author":"Meng","year":"2020","journal-title":"arXiv:2001.00308"},{"key":"ref16","first-page":"4970","article-title":"Improving adversarial robustness via promoting ensemble diversity","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16955"},{"key":"ref18","first-page":"2880","article-title":"Learning diverse-structured networks for adversarial robustness","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Du"},{"key":"ref19","article-title":"Building robust ensembles via margin boosting","author":"Zhang","year":"2022","journal-title":"arXiv:2206.03362"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ISQED51717.2021.9424353"},{"key":"ref21","article-title":"n-ML: Mitigating adversarial examples via ensembles of topologically manipulated classifiers","author":"Sharif","year":"2019","journal-title":"arXiv:1912.09059"},{"key":"ref22","first-page":"5505","article-title":"DVERGE: Diversifying vulnerabilities for enhanced robust generation of ensembles","volume-title":"Proc. 34th Conf. Neural Inf. Process. Syst.","author":"Yang"},{"key":"ref23","article-title":"ATHENA: A framework based on diverse weak defenses for building adversarial defense","author":"Meng","year":"2020","journal-title":"arXiv:2001.00308"},{"key":"ref24","first-page":"1","article-title":"Simple and scalable predictive uncertainty estimation using deep ensembles","volume-title":"Proc. 31st Conf. Neural Inf. Process. Syst.","author":"Lakshminarayanan"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref26","article-title":"Mitigating adversarial effects through randomization","author":"Xie","year":"2017","journal-title":"arXiv:1711.01991"},{"key":"ref27","first-page":"7717","article-title":"Randomization matters how to defend against strong adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pinot"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/MASS.2019.00040"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2019.8851823"},{"key":"ref30","article-title":"Why M heads are better than one: Training a diverse ensemble of deep networks","author":"Lee","year":"2015","journal-title":"arXiv:1511.06314"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378532"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3466752.3480082"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00066"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00031"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3240765.3240791"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3445814.3446747"},{"key":"ref37","article-title":"DNNShield: Dynamic Randomized model sparsification, a defense against adversarial machine learning","author":"Samavatian","year":"2022","journal-title":"arXiv:2208.00498"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/TED.2020.2998457"},{"key":"ref39","volume-title":"NVIDIA A100","year":"2021"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA47549.2020.00027"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO50266.2020.00062"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA45697.2020.00081"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/VLSITechnologyandCir46769.2022.9830509"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA51647.2021.00016"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2021.3104240"},{"key":"ref46","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i12.26722"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP40776.2020.9052967"},{"key":"ref49","article-title":"On the robustness of randomized classifiers to adversarial examples","author":"Pinot","year":"2021","journal-title":"arXiv:2102.10875"},{"key":"ref50","article-title":"Breaking transferability of adversarial samples with randomness","author":"Zhou","year":"2018","journal-title":"arXiv:1805.04613"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3024660"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3474370.3485659"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/833"},{"key":"ref54","article-title":"Block switching: A stochastic approach for deep learning security","author":"Wang","year":"2020","journal-title":"arXiv:2002.07920"},{"key":"ref55","article-title":"Stochastic combinatorial ensembles for defending against adversarial examples","author":"Adam","year":"2018","journal-title":"arXiv:1808.06645"},{"key":"ref56","article-title":"Robust ensemble model training via random layer sampling against adversarial attack","author":"Lee","year":"2021","journal-title":"arXiv:2005.10757"},{"key":"ref57","article-title":"Dynamic stochastic ensemble with adversarial robust lottery ticket subnetworks","author":"Peng","year":"2022","journal-title":"arXiv:2210.02618"},{"key":"ref58","first-page":"7717","article-title":"Randomization matters how to defend against strong adversarial attacks","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Pinot"},{"key":"ref59","article-title":"Adversarial vulnerability of randomized ensembles","author":"Dbouk","year":"2022","journal-title":"arXiv:2206.06737"},{"key":"ref60","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Krizhevsky"},{"key":"ref61","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2015","journal-title":"arXiv:1409.1556"},{"key":"ref62","article-title":"MobileNets: Efficient convolutional neural networks for mobile vision applications","author":"Howard","year":"2017","journal-title":"arXiv:1704.04861"},{"key":"ref63","article-title":"SqueezeNet: AlexNet-level accuracy with 50x fewer parameters and < 0.5 MB model size","author":"Iandola","year":"2016","journal-title":"arXiv:1602.07360"},{"key":"ref64","first-page":"6105","article-title":"EfficientNet: Rethinking model scaling for convolutional neural networks","volume-title":"Proc. 36th Int. Conf. Mach. Learn.","author":"Tan"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/2528521.1508274"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/FCCM48280.2020.00023"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3489517.3530506"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2013.6522334"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2016.7783720"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2016.42"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2018.00069"},{"key":"ref72","volume-title":"Nvidia nvdla","year":"2017"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3037697.3037700"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/ISPA\/IUCC.2017.00087"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/2508148.2485974"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/2628071.2628117"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2018.2856261"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3352460.3358252"},{"key":"ref79","article-title":"Evolution strategies as a scalable alternative to reinforcement learning","author":"Salimans","year":"2017","journal-title":"arXiv:1703.03864"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA53966.2022.00065"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/BF00175354"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/21.97458"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00010"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2007.33"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/LCA.2015.2414456"},{"key":"ref86","article-title":"SCALE-Sim: Systolic CNN accelerator simulator","author":"Samajdar","year":"2019","journal-title":"arXiv:1811.02883"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.4324\/9781410605337-29"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref90","article-title":"YOLOv3: An incremental improvement","author":"Redmon","year":"2018","journal-title":"arXiv:1804.02767"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref93","first-page":"1","article-title":"Skip connections matter: On the transferability of adversarial examples generated with ResNets","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref94","article-title":"Serving DNN models with multi-instance GPUs: A case of the reconfigurable machine scheduling problem","author":"Tan","year":"2021","journal-title":"arXiv:2109.11067"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/PACT52795.2021.00019"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA51647.2021.00056"},{"key":"ref97","article-title":"Domain-specific genetic algorithm for multi-tenant DNNAccelerator scheduling","author":"Kao","year":"2021","journal-title":"arXiv:2104.13997"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507752"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA.2018.00069"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3296957.3173176"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/JETCAS.2019.2910232"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2018.00080"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2016.7783720"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/2654822.2541967"},{"key":"ref105","article-title":"FlexSA: Flexible systolic array architecture for efficient pruned DNN model training","author":"Lym","year":"2020","journal-title":"arXiv:2004.13027"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2019.00030"}],"container-title":["IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/43\/10684348\/10502340.pdf?arnumber=10502340","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,20]],"date-time":"2024-09-20T17:25:28Z","timestamp":1726853128000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10502340\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10]]},"references-count":106,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tcad.2024.3390031","relation":{},"ISSN":["0278-0070","1937-4151"],"issn-type":[{"value":"0278-0070","type":"print"},{"value":"1937-4151","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10]]}}}