{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,20]],"date-time":"2026-07-20T18:29:21Z","timestamp":1784572161542,"version":"3.55.0"},"reference-count":62,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100002428","name":"Austrian Science Fund","doi-asserted-by":"publisher","award":["I 4057-N31"],"award-info":[{"award-number":["I 4057-N31"]}],"id":[{"id":"10.13039\/501100002428","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001824","name":"Czech Science Foundation","doi-asserted-by":"publisher","award":["22-32620S"],"award-info":[{"award-number":["22-32620S"]}],"id":[{"id":"10.13039\/501100001824","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001824","name":"Czech Science Foundation","doi-asserted-by":"publisher","award":["19-29680L"],"award-info":[{"award-number":["19-29680L"]}],"id":[{"id":"10.13039\/501100001824","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001824","name":"Czech Science Foundation","doi-asserted-by":"publisher","award":["22-32620S"],"award-info":[{"award-number":["22-32620S"]}],"id":[{"id":"10.13039\/501100001824","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/tifs.2024.3379829","type":"journal-article","created":{"date-parts":[[2024,3,20]],"date-time":"2024-03-20T18:17:29Z","timestamp":1710958649000},"page":"4670-4685","source":"Crossref","is-referenced-by-count":4,"title":["On the Economics of Adversarial Machine Learning"],"prefix":"10.1109","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3562-5265","authenticated-orcid":false,"given":"Florian","family":"Merkle","sequence":"first","affiliation":[{"name":"Department of Information Systems, Productions and Logistic, University of Innsbruck, Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8521-8142","authenticated-orcid":false,"given":"Maximilian","family":"Samsinger","sequence":"additional","affiliation":[{"name":"Department of Digital Business and Software Engineering, MCI Innsbruck, Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8710-9188","authenticated-orcid":false,"given":"Pascal","family":"Sch\u00f6ttle","sequence":"additional","affiliation":[{"name":"Department of Digital Business and Software Engineering, MCI Innsbruck, Innsbruck, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5768-9713","authenticated-orcid":false,"given":"Tomas","family":"Pevny","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Czech Technical University in Prague, Prague, Czech Republic"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref2","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref3","first-page":"17258","article-title":"Robustness and accuracy could be reconcilable by definition","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref4","article-title":"Mitigating the accuracyrobustness trade-off via multi-teacher adversarial distillation","author":"Zhao","year":"2023","journal-title":"arXiv:2306.16170"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-90370-1_9"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-010-5188-5"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020495"},{"key":"ref9","first-page":"1467","article-title":"Poisoning attacks against support vector machines","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Biggio"},{"issue":"1","key":"ref10","first-page":"2617","article-title":"Static prediction games for adversarial learning problems","volume":"13","author":"Br\u00fcckner","year":"2012","journal-title":"J. Mach. Learn. Res."},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref12","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"ref14","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Brendel"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2017.49"},{"key":"ref17","article-title":"Transferability in machine learning: From phenomena to black-box attacks using adversarial samples","author":"Papernot","year":"2016","journal-title":"arXiv:1605.07277"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_39"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref21","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref22","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Tramer"},{"key":"ref23","first-page":"1310","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Cohen"},{"key":"ref24","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wong"},{"key":"ref25","first-page":"1884","article-title":"Armor security for Los Angeles international airport","volume-title":"Proc. AAAI","author":"Pita"},{"key":"ref26","volume-title":"Information Rules: A Strategic Guide To the Network Economy","author":"Shapiro","year":"1999"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2001.991552"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1126\/science.1130992"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2009.2019154"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-17197-0_9"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2012.2237397"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2509941"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-68711-7_21"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/1143844.1143889"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2718494"},{"key":"ref36","first-page":"7677","article-title":"Mixed Nash equilibria in the adversarial examples game","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Meunier"},{"key":"ref37","first-page":"7717","article-title":"Randomization matters how to defend against strong adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pinot"},{"key":"ref38","first-page":"1","article-title":"Adversarial training should be cast as a non-zero-sum game","volume-title":"Proc. The 12th Int. Conf. Learn. Represent.","author":"Robey"},{"key":"ref39","article-title":"Motivating the rules of the game for adversarial example research","author":"Gilmer","year":"2018","journal-title":"arXiv:1807.06732"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML54575.2023.00031"},{"key":"ref41","first-page":"1","article-title":"\u2018Why do so?\u2019\u2014A practical perspective on machine learning security","volume-title":"Proc. 39th Int. Conf. Mach. Learn.","author":"Grosse"},{"key":"ref42","article-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019","journal-title":"arXiv:1902.06705"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3411508.3421376"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.2200\/s00108ed1v01y200802aim003"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.2307\/1969529"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1137\/0112064"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/cvpr.2018.00474"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref51","volume-title":"Learning Multiple Layers of Features From Tiny Images","author":"Krizhevsky","year":"2009"},{"key":"ref52","first-page":"1","article-title":"SGDR: Stochastic gradient descent with warm restarts","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Loshchilov"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1161366.1161393"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijpe.2008.04.002"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i6.16641"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3437880.3460407"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.23919\/EUSIPCO.2018.8553214"},{"key":"ref59","first-page":"1","article-title":"Excessive invariance causes adversarial vulnerability","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Jacobsen"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2018.00211"},{"key":"ref61","first-page":"1","article-title":"Spatially transformed adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Xiao"},{"issue":"1","key":"ref62","first-page":"5","article-title":"La cryptographie militaire","volume":"9","author":"Kerckhoffs","year":"1883","journal-title":"J. Des. Sci. Militaires"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/10319981\/10476499.pdf?arnumber=10476499","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,5,8]],"date-time":"2024-05-08T04:45:38Z","timestamp":1715143538000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10476499\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":62,"URL":"https:\/\/doi.org\/10.1109\/tifs.2024.3379829","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}