{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,16]],"date-time":"2026-05-16T04:06:41Z","timestamp":1778904401505,"version":"3.51.4"},"reference-count":105,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62532016"],"award-info":[{"award-number":["62532016"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372236"],"award-info":[{"award-number":["62372236"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["6257071391"],"award-info":[{"award-number":["6257071391"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62502309"],"award-info":[{"award-number":["62502309"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003395","name":"Shanghai Municipal Education Commission","doi-asserted-by":"publisher","award":["ZXDF030140"],"award-info":[{"award-number":["ZXDF030140"]}],"id":[{"id":"10.13039\/501100003395","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007219","name":"Natural Science Foundation of Shanghai","doi-asserted-by":"publisher","award":["25ZR1402211"],"award-info":[{"award-number":["25ZR1402211"]}],"id":[{"id":"10.13039\/100007219","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1109\/tdsc.2026.3656508","type":"journal-article","created":{"date-parts":[[2026,1,21]],"date-time":"2026-01-21T21:13:22Z","timestamp":1769030002000},"page":"5542-5558","source":"Crossref","is-referenced-by-count":0,"title":["From Pixels to Trajectory: Universal Adversarial Example Detection via Temporal Imprints"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6029-5064","authenticated-orcid":false,"given":"Yansong","family":"Gao","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Southeast University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7323-9093","authenticated-orcid":false,"given":"Huaibing","family":"Peng","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hua","family":"Ma","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Eveleigh, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiyang","family":"Dai","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8938-2364","authenticated-orcid":false,"given":"Shuo","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongsheng","family":"Hu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1632-5737","authenticated-orcid":false,"given":"Anmin","family":"Fu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Nanjing University of Science and Technology, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9172-4252","authenticated-orcid":false,"given":"Minhui","family":"Xue","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Eveleigh, NSW, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00014"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00759"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/fg.2017.20"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/s10462-021-10125-w"},{"key":"ref5","first-page":"173","article-title":"Deep speech 2: End-to-end speech recognition in English and Mandarin","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Amodei","year":"2016"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179360"},{"key":"ref7","first-page":"4218","article-title":"Common voice: A massively-multilingual speech corpus","volume-title":"Proc. 12th Lang. Resour. Eval. Conf.","author":"Ardila","year":"2020"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2019.2943232"},{"key":"ref9","article-title":"Interpreting and explaining deep neural networks for classification of audio signals","author":"Becker","year":"2018"},{"key":"ref10","first-page":"643","article-title":"Towards targeted obfuscation of adversarial unsafe images using reconstruction and counterfactual super region attribution explainability","volume-title":"Proc. USENIX Secur. Symp.","volume":"2023","author":"Bethany"},{"key":"ref11","first-page":"77","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Adv. Reliably Eval. Improving Adversarial Robustness","author":"Brendel","year":"2021"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179336"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24103"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-33383-5_25"},{"key":"ref16","article-title":"Unsupervised adversarial detection without extra model: Training loss should change","volume-title":"Proc. 2nd Workshop New Frontiers Adversarial Mach. Learn.","author":"Chyou","year":"2023"},{"key":"ref17","first-page":"215","article-title":"An analysis of single-layer networks in unsupervised feature learning","volume-title":"Proc. Fourteenth Int. Conf. Artif. Intell. Statist.","author":"Coates","year":"2011"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01446"},{"key":"ref19","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce","year":"2020"},{"key":"ref20","first-page":"1115","article-title":"Adversarial attack on graph structured data","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Dai","year":"2018"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1810.04805"},{"key":"ref22","article-title":"A study of the effect of JPG compression on adversarial images","author":"Dziugaite","year":"2016"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-2006"},{"key":"ref24","article-title":"End-to-end workflow from training to deployment for iOS and android mobile devices","year":"2021"},{"key":"ref25","article-title":"Detecting adversarial samples from artifacts","author":"Feinman","year":"2017"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"ref27","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020"},{"key":"ref28","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow","year":"2015"},{"key":"ref29","article-title":"Deploy machine learning models on mobile and edge devices","year":"2021"},{"key":"ref30","article-title":"On the (statistical) detection of adversarial examples","author":"Grosse","year":"2017"},{"key":"ref31","article-title":"Countering adversarial images using input transformations","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Guo","year":"2018"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3594869"},{"key":"ref33","article-title":"Parameter-efficient fine-tuning for large models: A comprehensive survey","author":"Han","year":"2024","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.52202\/068431-1730"},{"issue":"2","key":"ref36","article-title":"Low-rank adaptation of large language models","volume-title":"Proc. Int. Conf. Learn. Representations","volume":"1","author":"Edward","year":"2022"},{"key":"ref37","first-page":"2273","article-title":"WaveGuard: Understanding and mitigating audio adversarial examples","volume-title":"Proc. USENIX Secur. Symp.","author":"Hussain","year":"2021"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1117\/12.242059"},{"key":"ref39","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref41","article-title":"Tiny imagenet visual recognition challenge","author":"Le","year":"2015","journal-title":"CS"},{"key":"ref42","article-title":"A simple unified framework for detecting out-of-distribution samples and adversarial attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"31","author":"Lee","year":"2018"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23138"},{"key":"ref44","first-page":"236","article-title":"Self-supervised representation learning for adversarial attack detection","volume-title":"Proc. Eur. Conf. Comput. Vis.","author":"Li","year":"2024"},{"key":"ref45","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Li"},{"key":"ref46","article-title":"Rethinking data protection in the (generative) artificial intelligence era","author":"Li","year":"2025"},{"key":"ref47","first-page":"1218","article-title":"A robustly optimized bert pretraining approach","volume-title":"Proc. 20th Chinese National Conf. Computat. Linguistics","author":"Liu","year":"2021"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560684"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00095"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3271956"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23415"},{"key":"ref52","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Ma","year":"2018"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3485133"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00690-w"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref58","first-page":"3763","article-title":"Security is not my field, i\u2019ma stats guy\u201d: A qualitative root cause analysis of barriers to adversarial machine learning defenses in industry","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Mink","year":"2023"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2015.7178964"},{"key":"ref61","article-title":"Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning","author":"Papernot","year":"2018"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00894"},{"key":"ref65","article-title":"Reducing excessive margin to achieve a better accuracy vs. robustness trade-off","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Rade","year":"2021"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref67","first-page":"4393","article-title":"Deep one-class classification","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ruff","year":"2018"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179281"},{"key":"ref69","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","volume-title":"Proc. 6th Int. Conf. Learn. Representations","author":"Samangouei","year":"2018"},{"key":"ref70","article-title":"Robust learning meets generative models: Can proxy distributions improve adversarial robustness?","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Sehwag","year":"2021"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417231"},{"key":"ref72","article-title":"DATABench: Evaluating dataset auditing in deep learning from an adversarial perspective","author":"Shao","year":"2025"},{"key":"ref73","first-page":"3745","article-title":"The space of adversarial strategies","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur. 23)","author":"Sheatsley","year":"2023"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421381"},{"key":"ref75","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. 3rd Int. Conf. Learn. Representations","author":"Simonyan","year":"2015"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"ref77","article-title":"Physical adversarial examples for object detectors","volume-title":"Proc. 12th USENIX Workshop Offensive Technol. (WOOT 18)","author":"Song","year":"2018"},{"key":"ref78","first-page":"877","article-title":"Towards robust LiDAR-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur. 20)","author":"Sun","year":"2020"},{"key":"ref79","article-title":"Peernets: Exploiting peer wisdom against adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Svoboda","year":"2019"},{"key":"ref80","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1023\/B:MACH.0000008084.60811.49"},{"key":"ref82","article-title":"Test-time detection and repair of adversarial samples via masked autoencoder","volume-title":"Proc. IEEE\/CVF Comput. Vis. Pattern Recognit. Conf.","author":"Tsai","year":"2023"},{"issue":"11","key":"ref83","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1221"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00407"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP42928.2021.9506292"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3269012"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2024.3449908"},{"key":"ref89","first-page":"2065","article-title":"$\\lbrace${PatchCleanser$\\rbrace$}: Certifiably robust defense against adversarial patches for any image classifier","volume-title":"Proc. USENIX Secur. Symp.","author":"Xiang","year":"2022"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179319"},{"key":"ref91","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xie","year":"2018"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-019-1211-x"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2022.24001"},{"key":"ref97","first-page":"3799","article-title":"SMACK: Semantically meaningful adversarial audio attack","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur. 23)","author":"Yu","year":"2023"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1049\/csy2.12117"},{"key":"ref99","first-page":"4787","article-title":"DiffSmooth: Certifiably robust learning via diffusion models and local smoothing","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur. 23)","author":"Zhang","year":"2023"},{"key":"ref100","first-page":"679","article-title":"CAPatch: Physical adversarial patch against image captioning systems","volume-title":"Proc. USENIX Secur. Symp.","author":"Zhang","year":"2023"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3304455"},{"key":"ref102","article-title":"Interpretable deep learning under fire","volume-title":"Proc. Usenix Secur. Symp.","author":"Zhang","year":"2020"},{"key":"ref103","first-page":"42517","article-title":"Eliminating adversarial noise via information discard and robust representation restoration","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhou","year":"2023"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3340889"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179473"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11517592\/11359755.pdf?arnumber=11359755","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,16]],"date-time":"2026-05-16T03:08:49Z","timestamp":1778900929000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11359755\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":105,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2026.3656508","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5]]}}}