{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,18]],"date-time":"2026-07-18T17:51:05Z","timestamp":1784397065297,"version":"3.55.0"},"reference-count":90,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Dutch National e-Infrastructure through the SURF Cooperative"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/tifs.2023.3275057","type":"journal-article","created":{"date-parts":[[2023,5,11]],"date-time":"2023-05-11T00:43:26Z","timestamp":1683765806000},"page":"3185-3197","source":"Crossref","is-referenced-by-count":13,"title":["Adversarial Image Color Transformations in Explicit Color Filter Space"],"prefix":"10.1109","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0745-4294","authenticated-orcid":false,"given":"Zhengyu","family":"Zhao","sequence":"first","affiliation":[{"name":"Ministry of Education Key Laboratory for Intelligent Networks and Network Security, School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0049-7080","authenticated-orcid":false,"given":"Zhuoran","family":"Liu","sequence":"additional","affiliation":[{"name":"Institute for Computing and Information Sciences, Radboud University, Nijmegen, The Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1430-4721","authenticated-orcid":false,"given":"Martha","family":"Larson","sequence":"additional","affiliation":[{"name":"Institute for Computing and Information Sciences, Radboud University, Nijmegen, The Netherlands"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","first-page":"1","article-title":"Functional adversarial attacks","author":"laidlaw","year":"2019","journal-title":"Proc NeurIPS"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.632"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00212"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3072959.3073592"},{"key":"ref15","first-page":"1625","article-title":"Robust physical-world attacks on deep learning models","author":"eykholt","year":"2018","journal-title":"Proc CVPR"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2017.2688929"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00123"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.244"},{"key":"ref53","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","author":"wong","year":"2020","journal-title":"Proc ICLR"},{"key":"ref52","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","author":"zhang","year":"2019","journal-title":"Proc ICML"},{"key":"ref11","first-page":"1","article-title":"Unrestricted adversarial examples via semantic manipulation","author":"bhattad","year":"2020","journal-title":"Proc ICLR"},{"key":"ref55","first-page":"1","article-title":"Defending against physically realizable attacks on image classification","author":"wu","year":"2020","journal-title":"Proc ICLR"},{"key":"ref10","article-title":"Motivating the rules of the game for adversarial example research","author":"gilmer","year":"2018","journal-title":"arXiv 1807 06732"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00068"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58568-6_2"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00487"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3181974"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978392"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140444"},{"key":"ref50","first-page":"1","article-title":"Mitigating adversarial effects through randomization","author":"xie","year":"2018","journal-title":"Proc ICLR"},{"key":"ref90","first-page":"1","article-title":"Adversarial examples are not bugs, they are features","author":"ilyas","year":"2019","journal-title":"Proc NeurIPS"},{"key":"ref46","first-page":"1","article-title":"Characterizing adversarial subspaces using local intrinsic dimensionality","author":"ma","year":"2018","journal-title":"Proc ICLR"},{"key":"ref45","article-title":"On the (statistical) detection of adversarial examples","author":"grosse","year":"2017","journal-title":"arXiv 1702 06280"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2012.6247954"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219910"},{"key":"ref47","first-page":"1","article-title":"On detecting adversarial perturbations","author":"metzen","year":"2017","journal-title":"Proc ICLR"},{"key":"ref42","first-page":"6808","article-title":"Wasserstein adversarial examples via projected sinkhorn iterations","author":"wong","year":"2019","journal-title":"Proc ICML"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.119"},{"key":"ref41","first-page":"1802","article-title":"Exploring the landscape of spatial robustness","author":"engstrom","year":"2019","journal-title":"Proc ICML"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-014-0733-5"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3072959.3073703"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2018.2831899"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00112"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.60"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3323873.3325052"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2019.2919707"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00514"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"key":"ref3","first-page":"1","article-title":"Explaining and harnessing adversarial examples","author":"goodfellow","year":"2015","journal-title":"Proc ICLR"},{"key":"ref6","first-page":"1989","article-title":"Seeing isn’t believing: Towards more robust adversarial attack against real world object detectors","author":"zhao","year":"2019","journal-title":"Proc ACM CCS"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.153"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3240508.3240698"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2017.09.025"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00467"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.660"},{"key":"ref83","article-title":"Rethinking atrous convolution for semantic image segmentation","author":"chen","year":"2017","journal-title":"arXiv 1706 05587"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2723009"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2003.819861"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2020.2987694"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00482"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2019.8682225"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11499"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2016.58"},{"key":"ref31","first-page":"1","article-title":"Adversarial examples in the physical world","author":"kurakin","year":"2017","journal-title":"Proc ICLR"},{"key":"ref75","first-page":"1","article-title":"Selection of source images heavily influences the effectiveness of adversarial attacks","author":"ozbulak","year":"2021","journal-title":"Proc BMVC"},{"key":"ref30","first-page":"1","article-title":"Adversarial color enhancement: Generating unrestricted adversarial images by optimizing a color filter","author":"zhao","year":"2020","journal-title":"Proc BMVC"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2022.108728"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00445"},{"key":"ref77","first-page":"1","article-title":"Countering adversarial images using input transformations","author":"guo","year":"2018","journal-title":"Proc ICLR"},{"key":"ref32","first-page":"1","article-title":"Towards deep learning models resistant to adversarial attacks","author":"madry","year":"2018","journal-title":"Proc ICLR"},{"key":"ref76","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","author":"zhao","year":"2021","journal-title":"Proc NeurIPS"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref1","first-page":"1","article-title":"Intriguing properties of neural networks","author":"szegedy","year":"2014","journal-title":"Proc ICLR"},{"key":"ref39","first-page":"1","article-title":"Spatially transformed adversarial examples","author":"xiao","year":"2018","journal-title":"Proc ICLR"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1186\/s13635-020-00112-z"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref70","first-page":"1","article-title":"Very deep convolutional networks for large-scale image recognition","author":"simonyan","year":"2015","journal-title":"Proc ICLR"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01492"},{"key":"ref72","first-page":"1","article-title":"Delving into transferable adversarial examples and black-box attacks","author":"liu","year":"2017","journal-title":"Proc ICLR"},{"key":"ref24","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","author":"athalye","year":"2018","journal-title":"Proc ICML"},{"key":"ref68","first-page":"1","article-title":"ImageNet classification with deep convolutional neural networks","author":"krizhevsky","year":"2012","journal-title":"Proc NeurIPS"},{"key":"ref23","author":"wu","year":"2022","journal-title":"BlackboxBench A Comprehensive Benchmark for Evaluating Black-Box Attacks"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref26","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","author":"tramer","year":"2020","journal-title":"Proc NeurIPS"},{"key":"ref25","article-title":"On evaluating adversarial robustness","author":"carlini","year":"2019","journal-title":"arXiv 1902 06705"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref20","first-page":"1","article-title":"ADef: An iterative algorithm to construct adversarial deformations","author":"alaifari","year":"2019","journal-title":"Proc ICLR"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref63","article-title":"Learning multiple layers of features from tiny images","author":"krizhevsky","year":"2009"},{"key":"ref22","first-page":"1","article-title":"RobustBench: A standardized adversarial robustness benchmark","author":"croce","year":"2021","journal-title":"Proc NeurIPS Datasets Benchmarks Track"},{"key":"ref66","first-page":"1","article-title":"Adversarial training for free!","author":"shafahi","year":"2019","journal-title":"Proc NeurIPS"},{"key":"ref21","first-page":"1","article-title":"Perceptual adversarial robustness: Defense against unseen threat models","author":"laidlaw","year":"2021","journal-title":"Proc ICLR"},{"key":"ref65","first-page":"1","article-title":"Intriguing properties of adversarial training at scale","author":"xie","year":"2020","journal-title":"Proc ICLR"},{"key":"ref28","first-page":"1","article-title":"Pixel privacy: Increasing image appeal while blocking automatic inference of sensitive scene information","author":"larson","year":"2018","journal-title":"Proc MediaEval Multimedia Benchmark Workshop"},{"key":"ref27","first-page":"1","article-title":"LowKey: Leveraging adversarial attacks to protect social media users from facial recognition","author":"cherepanova","year":"2021","journal-title":"Proc ICLR"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2021-0006"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3080543"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-94042-7_11"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6928"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9970396\/10122680.pdf?arnumber=10122680","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,6,12]],"date-time":"2023-06-12T18:00:20Z","timestamp":1686592820000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10122680\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":90,"URL":"https:\/\/doi.org\/10.1109\/tifs.2023.3275057","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}