{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,23]],"date-time":"2026-02-23T17:24:27Z","timestamp":1771867467880,"version":"3.50.1"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T00:00:00Z","timestamp":1740787200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"JSPS KAKENHI","award":["JP21H04907"],"award-info":[{"award-number":["JP21H04907"]}]},{"name":"JSPS KAKENHI","award":["JP24H00732"],"award-info":[{"award-number":["JP24H00732"]}]},{"name":"JST CREST","award":["JPMJCR18A6"],"award-info":[{"award-number":["JPMJCR18A6"]}]},{"name":"JST CREST","award":["JPMJCR20D3"],"award-info":[{"award-number":["JPMJCR20D3"]}]},{"name":"JST AIP Acceleration","award":["JPMJCR24U3"],"award-info":[{"award-number":["JPMJCR24U3"]}]},{"name":"JST K Program","award":["JPMJKP24C2"],"award-info":[{"award-number":["JPMJKP24C2"]}]},{"name":"Development and Demonstration of Countermeasures Against Disinformation and Misinformation on the Internet with the Ministry of Internal Affairs and Communications of Japan"},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376003"],"award-info":[{"award-number":["62376003"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003995","name":"Natural Science Foundation of Anhui Province","doi-asserted-by":"publisher","award":["2308085MF200"],"award-info":[{"award-number":["2308085MF200"]}],"id":[{"id":"10.13039\/501100003995","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Faculty Initiatives Research, Monash University","award":["2901912"],"award-info":[{"award-number":["2901912"]}]},{"name":"NVIDIA Academic Hardware"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,3]]},"DOI":"10.1109\/tdsc.2024.3472569","type":"journal-article","created":{"date-parts":[[2024,10,2]],"date-time":"2024-10-02T18:30:56Z","timestamp":1727893856000},"page":"1827-1844","source":"Crossref","is-referenced-by-count":2,"title":["Iterative Window Mean Filter: Thwarting Diffusion-Based Adversarial Purification"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-0498-2712","authenticated-orcid":false,"given":"Hanrui","family":"Wang","sequence":"first","affiliation":[{"name":"National Institute of Informatics (NII), Tokyo, Japan"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5404-8550","authenticated-orcid":false,"given":"Ruoxi","family":"Sun","sequence":"additional","affiliation":[{"name":"CSIRO’s Data61, Eveleigh, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2926-9762","authenticated-orcid":false,"given":"Cunjian","family":"Chen","sequence":"additional","affiliation":[{"name":"Monash University, Clayton, VIC, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9172-4252","authenticated-orcid":false,"given":"Minhui","family":"Xue","sequence":"additional","affiliation":[{"name":"CSIRO’s Data61, Eveleigh, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lay-Ki","family":"Soon","sequence":"additional","affiliation":[{"name":"Monash University, Subang Jaya, Malaysia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shuo","family":"Wang","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4501-7992","authenticated-orcid":false,"given":"Zhe","family":"Jin","sequence":"additional","affiliation":[{"name":"Anhui Provincial Key Laboratory of Secure Artificial Intelligence, Anhui University, Anhui, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref2","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref3","article-title":"Threat model-agnostic adversarial defense using diffusion models","author":"Blau","year":"2022"},{"key":"ref4","article-title":"Thermometer encoding: One hot way to resist adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Buckman"},{"key":"ref5","article-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01475"},{"key":"ref9","first-page":"854","article-title":"Parseval networks: Improving robustness to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cisse"},{"key":"ref10","article-title":"RobustBench: A standardized adversarial robustness benchmark","volume-title":"Proc. 35th Conf. Neural Inf. Process. Syst. Datasets Benchmarks Track","author":"Croce"},{"key":"ref11","first-page":"4421","article-title":"Evaluating the adversarial robustness of adaptive test-time defenses","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref12","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00482"},{"key":"ref14","article-title":"Stochastic activation pruning for robust adversarial defense","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Guneet"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref16","article-title":"Detecting adversarial samples from artifacts","author":"Feinman","year":"2017"},{"key":"ref17","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0020"},{"issue":"1","key":"ref19","first-page":"723","article-title":"A kernel two-sample test","volume":"13","author":"Gretton","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref20","article-title":"On the (statistical) detection of adversarial examples","author":"Grosse","year":"2017"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.32657\/10356\/143316"},{"key":"ref22","article-title":"Countering adversarial images using input transformations","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Guo"},{"key":"ref23","article-title":"Early methods for detecting adversarial images","author":"Hendrycks","year":"2016"},{"key":"ref24","article-title":"Distilling the knowledge in a neural network","author":"Hinton","year":"2015"},{"key":"ref25","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Ho"},{"key":"ref26","article-title":"Labeled faces in the wild: A database forstudying face recognition in unconstrained environments","volume-title":"Proc. Workshop Faces \u2018Real-Life\u2019 Images: Detection, Alignment, Recognit.","author":"Gary"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-77326-1"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00624"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/BF00941892"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00813"},{"key":"ref31","article-title":"Denoising diffusion restoration models","volume-title":"Proc. ICLR Workshop Deep Generative Models Highly Structured Data","author":"Kawar"},{"key":"ref32","article-title":"Auto-encoding variational bayes","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kingma"},{"key":"ref33","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kurakin"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref35","article-title":"Perceptual adversarial robustness: Defense against unseen threat models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Laidlaw Singla"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00019"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.615"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.425"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2020.2970615"},{"key":"ref43","article-title":"Distributional smoothing with virtual adversarial training","author":"Miyato","year":"2015"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref45","first-page":"16805","article-title":"Diffusion models for adversarial purification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Nie"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref48","first-page":"23063","article-title":"Indicators of attack failure: Debugging and improving optimization of adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Pintor"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3195384"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00232"},{"key":"ref51","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Samangouei"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"ref53","article-title":"Adversarial training for free!","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shafahi"},{"key":"ref54","article-title":"Denoising diffusion implicit models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Song"},{"key":"ref55","article-title":"PixelDefend: Leveraging generative models to understand and defend against adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Song"},{"key":"ref56","first-page":"1299","article-title":"When does machine learning $\\lbrace${FAIL$\\rbrace$}? generalized transferability for evasion and poisoning attacks","volume-title":"Proc. 27th USENIX Secur. Symp.","author":"Suciu"},{"key":"ref57","article-title":"PointDP: Diffusion-driven purification against adversarial attacks on 3D point cloud recognition","author":"Sun","year":"2022"},{"key":"ref58","article-title":"Intriguing properties of neural networks","volume-title":"Proc. 2nd Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00012"},{"key":"ref60","article-title":"Ensemble adversarial training: Attacks and defenses","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Tram\u00e8r"},{"key":"ref61","first-page":"19667","article-title":"NVAE: A deep hierarchical variational autoencoder","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Vahdat"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/FG52635.2021.9667076"},{"key":"ref63","article-title":"Guided diffusion model for adversarial purification","author":"Wang","year":"2022"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098158"},{"key":"ref65","article-title":"Guided diffusion model for adversarial purification from random noise","author":"Wu","year":"2022"},{"key":"ref66","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref71","article-title":"RobFR: Benchmarking adversarial robustness on face recognition","author":"Yang","year":"2020"},{"key":"ref72","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhang"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00665"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58577-8_18"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/10925471\/10704070.pdf?arnumber=10704070","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,17]],"date-time":"2025-03-17T21:20:55Z","timestamp":1742246455000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10704070\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3]]},"references-count":74,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2024.3472569","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3]]}}}