{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,13]],"date-time":"2026-03-13T15:05:51Z","timestamp":1773414351933,"version":"3.50.1"},"reference-count":66,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2020AAA0107702"],"award-info":[{"award-number":["2020AAA0107702"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62206217"],"award-info":[{"award-number":["62206217"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62006181"],"award-info":[{"award-number":["62006181"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62161160337"],"award-info":[{"award-number":["62161160337"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62132011"],"award-info":[{"award-number":["62132011"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21B2018"],"award-info":[{"award-number":["U21B2018"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U20A20177"],"award-info":[{"award-number":["U20A20177"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shaanxi Province Key Industry Innovation Program","award":["2023-ZDLGY-38"],"award-info":[{"award-number":["2023-ZDLGY-38"]}]},{"name":"Shaanxi Province Key Industry Innovation Program","award":["2021ZDLGY01-02"],"award-info":[{"award-number":["2021ZDLGY01-02"]}]},{"DOI":"10.13039\/501100002858","name":"China Post-Doctoral Science Foundation","doi-asserted-by":"publisher","award":["2022M722530"],"award-info":[{"award-number":["2022M722530"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002858","name":"China Post-Doctoral Science Foundation","doi-asserted-by":"publisher","award":["2023T160512"],"award-info":[{"award-number":["2023T160512"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["xzy012022082"],"award-info":[{"award-number":["xzy012022082"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/tifs.2023.3289000","type":"journal-article","created":{"date-parts":[[2023,7,3]],"date-time":"2023-07-03T14:00:04Z","timestamp":1688392804000},"page":"5936-5949","source":"Crossref","is-referenced-by-count":10,"title":["Revisiting Gradient Regularization: Inject Robust Saliency-Aware Weight Bias for Adversarial Defense"],"prefix":"10.1109","volume":"18","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0110-451X","authenticated-orcid":false,"given":"Qian","family":"Li","sequence":"first","affiliation":[{"name":"Ministry of Education Key Laboratory for Intelligent Networks and Network Security, School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}]},{"given":"Qingyuan","family":"Hu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6265-7345","authenticated-orcid":false,"given":"Chenhao","family":"Lin","sequence":"additional","affiliation":[{"name":"Ministry of Education Key Laboratory for Intelligent Networks and Network Security, School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6979-3537","authenticated-orcid":false,"given":"Di","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6959-0569","authenticated-orcid":false,"given":"Chao","family":"Shen","sequence":"additional","affiliation":[{"name":"Ministry of Education Key Laboratory for Intelligent Networks and Network Security, School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA.2018.8460487"},{"key":"ref2","article-title":"Can you fool AI with adversarial examples on a visual Turing test?","author":"Xu","year":"2017","journal-title":"arXiv:1709.08693"},{"key":"ref3","first-page":"1186","article-title":"Adversarial vulnerability for any classifier","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Fawzi"},{"key":"ref4","article-title":"Are adversarial examples inevitable","volume-title":"7th Int. Conf. Learn. Represent. (ICLR)","author":"Shafahi"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3021899"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref7","first-page":"1","article-title":"Adversarial machine learning at scale","volume-title":"Proc. 5th Int. Conf. Learn. Represent. (ICLR)","author":"Kurakin"},{"key":"ref8","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Wong"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3184262"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3152362"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/72.165600"},{"key":"ref12","article-title":"Jacobian adversarially regularized networks for robustness","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Chan"},{"key":"ref13","article-title":"Robust learning with Jacobian regularization","author":"Hoffman","year":"2019","journal-title":"arXiv:1908.02729"},{"key":"ref14","article-title":"Interpreting adversarial examples by activation promotion and suppression","author":"Xu","year":"2019","journal-title":"arXiv:1904.02057"},{"key":"ref15","article-title":"Robustness may be at odds with accuracy","volume-title":"Proc. 7th Int. Conf. Learn. Represent. (ICLR)","author":"Tsipras"},{"key":"ref16","first-page":"1014","article-title":"Proper network interpretability helps adversarial robustness in classification","volume-title":"Proc. 37th Int. Conf. Mach. Learn. (ICML)","volume":"119","author":"Boopathy"},{"key":"ref17","first-page":"1823","article-title":"On the connection between adversarial robustness and saliency map interpretability","volume-title":"Proc. 36th Int. Conf. Mach. Learn. (ICML)","author":"Etmann"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2017.2708039"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_32"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3062977"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2020\/324"},{"key":"ref22","article-title":"MMA training: Direct input space margin maximization through adversarial training","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Ding"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2956591"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3047752"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3003571"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3175603"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3195384"},{"key":"ref28","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. 3rd Int. Conf. Learn. Represent. (ICLR)","author":"Goodfellow"},{"key":"ref29","article-title":"Intriguing properties of neural networks","volume-title":"Proc. 2nd Int. Conf. Learn. Represent. (ICLR)","author":"Szegedy"},{"key":"ref30","first-page":"7025","article-title":"Me-Net: Towards effective adversarial robustness with matrix estimation","volume-title":"Proc. 36th Int. Conf. Mach. Learn. (ICML)","volume":"97","author":"Yang"},{"key":"ref31","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. 36th Int. Conf. Mach. Learn. (ICML)","author":"Zhang"},{"key":"ref32","first-page":"13847","article-title":"Adversarial robustness through local linearization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Qin"},{"key":"ref33","first-page":"1829","article-title":"Defense against adversarial attacks using feature scattering-based adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Zhang"},{"key":"ref34","article-title":"Improving adversarial robustness via channel-wise activation suppressing","author":"Bai","year":"2021","journal-title":"arXiv:2103.08307"},{"key":"ref35","article-title":"Toward adversarial training on contextualized language representation","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Wu"},{"key":"ref36","article-title":"On regularization and robustness of deep neural networks","volume":"abs\/1810.00363","author":"Bietti","year":"2018","journal-title":"CoRR"},{"key":"ref37","first-page":"6727","article-title":"Proven: Verifying robustness of neural networks with a probabilistic approach","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Weng"},{"key":"ref38","first-page":"10877","article-title":"Semidefinite relaxations for certifying robustness to adversarial examples","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Raghunathan"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3142993"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3155975"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3175616"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.1991.155328"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_32"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"ref45","first-page":"5809","article-title":"First-order adversarial vulnerability of neural networks and input dimension","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Simon-Gabriel"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2022.3184594"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17143-7_20"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v32i1.11504"},{"key":"ref49","article-title":"Unrestricted adversarial examples via semantic manipulation","volume-title":"Proc. 8th Int. Conf. Learn. Represent. (ICLR)","author":"Bhattad"},{"key":"ref50","article-title":"Adversarial training is a form of data-dependent operator norm regularization","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Roth"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-66415-2_3"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5888"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref54","article-title":"Deep inside convolutional networks: Visualising image classification models and saliency maps","volume-title":"Proc. 2nd Int. Conf. Learn. Represent. (ICLR)","author":"Simonyan"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2019.00014"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1996.tb02080.x"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58604-1_45"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2018.00097"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-019-01228-7"},{"key":"ref60","first-page":"4696","article-title":"When does label smoothing help?","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"M\u00fcller"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1016\/j.mlwa.2020.100017"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2017\/371"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"key":"ref64","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref65","first-page":"5032","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"80","author":"Uesato"},{"key":"ref66","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. 35th Int. Conf. Mach. Learn. (ICML)","author":"Athalye"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/9970396\/10171408.pdf?arnumber=10171408","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,27]],"date-time":"2026-01-27T05:42:58Z","timestamp":1769492578000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10171408\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":66,"URL":"https:\/\/doi.org\/10.1109\/tifs.2023.3289000","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}