{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,26]],"date-time":"2025-06-26T04:08:28Z","timestamp":1750910908484,"version":"3.41.0"},"reference-count":76,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3574977","type":"journal-article","created":{"date-parts":[[2025,6,3]],"date-time":"2025-06-03T17:48:59Z","timestamp":1748972939000},"page":"6205-6219","source":"Crossref","is-referenced-by-count":0,"title":["Resisting Bag-Based Attribute Profiling by Adding Adversarial Items to Existing Media Profiles"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0049-7080","authenticated-orcid":false,"given":"Zhuoran","family":"Liu","sequence":"first","affiliation":[{"name":"Institute for Computing and Information Sciences, Radboud University, Nijmegen, The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0745-4294","authenticated-orcid":false,"given":"Zhengyu","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1430-4721","authenticated-orcid":false,"given":"Martha","family":"Larson","sequence":"additional","affiliation":[{"name":"Institute for Computing and Information Sciences, Radboud University, Nijmegen, The Netherlands"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2016.10.013"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1140\/epjds\/s13688-017-0110-z"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref4","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.165"},{"key":"ref6","first-page":"1","article-title":"Pixel privacy. Increasing image appeal while blocking automatic inference of sensitive scene information","volume-title":"Proc. Work. Notes Proc. MediaEval Workshop","author":"Larson"},{"key":"ref7","first-page":"1589","article-title":"Fawkes: Protecting privacy against unauthorized deep learning models","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Shan"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01267-0_13"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"article-title":"CV Dazzle: Camouflage from computer vision","year":"2012","author":"Harvey","key":"ref11"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/WACV.2016.7477452"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46487-9_2"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3078971.3080543"},{"key":"ref15","first-page":"2187","article-title":"Glaze: Protecting artists from style mimicry by text-to-image models","volume-title":"Proc. USENIX Secur. Symp.","author":"Shan"},{"article-title":"Extraction and integration of MovieLens and IMDb data","year":"2007","author":"Peralta","key":"ref16"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1002\/asi.21001"},{"key":"ref18","first-page":"1","article-title":"Data poisoning won\u2019t save you from facial recognition","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Radiya-Dixit"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2023.3327017"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3275057"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23198"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3450613.3456832"},{"volume-title":"Data Protection Under GDPR","year":"2025","key":"ref23"},{"volume-title":"Laying Down Harmonised Rules on Artificial Intelligence and Amending Regulations (EC), no. 300\/2008, (EU), no. 167\/2013, (EU), no. 168\/2013, (EU) 2018\/858, (EU) 2018\/1139 and (EU) 2019\/2144 and Directives 2014\/90\/eu, (eu) 2016\/797 and (eu) 2020\/1828 (artificial Intelligence Act)","year":"2024","key":"ref24"},{"volume-title":"California Attorney General Clarifies That Inferences Are Personal Information","year":"2025","author":"Friel","key":"ref25"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1526709.1526781"},{"key":"ref27","first-page":"1","article-title":"You are what you like! Information leakage through users\u2019 interests","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Chaabane"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1218772110"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2594455"},{"key":"ref30","first-page":"979","article-title":"You are who you know and how you behave: Attribute inference attacks via users\u2019 social friends and behaviors","volume-title":"Proc. USENIX Secur. Symp.","author":"Gong"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052695"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3154793"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3123266.3123331"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.2478\/popets-2022-0002"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref36","first-page":"17","article-title":"Privacy in pharmacogenetics: An end-to-end case study of personalized Warfarin dosing","volume-title":"Proc. USENIX Secur. Symp.","author":"Fredrikson"},{"key":"ref37","first-page":"4579","article-title":"Are your sensitive attributes private? Novel model inversion attribute inference attacks on classification models","volume-title":"Proc. 31th Symp. Netw. Syst. Design Implement.","author":"Mehnaz"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/9780262029735.001.0001"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179445"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.174"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1155\/2017\/1897438"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/2365952.2365989"},{"key":"ref43","first-page":"513","article-title":"AttriGuard: A practical defense against attribute inference attacks via adversarial machine learning","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Jia"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1016\/j.ipm.2021.102722"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2017.10.009"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2015.03.008"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/1101149.1101236"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v31i1.10890"},{"key":"ref49","first-page":"1","article-title":"Deep sets","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zaheer"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1007\/s00138-021-01249-8"},{"key":"ref51","first-page":"3744","article-title":"Set transformer: A framework for attention-based permutation-invariant neural networks","volume-title":"Proc. ICML","author":"Lee"},{"key":"ref52","first-page":"2127","article-title":"Attention-based deep multiple instance learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Ilse"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1016\/j.jrp.2006.02.001"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298687"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v30i1.9987"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2015.7178964"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2018.8461375"},{"article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Simonyan","key":"ref60"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2022.3188113"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"volume-title":"1000 Musicians Drop \u2019silent Album\u2019 to Protest AI Copyright Stance","year":"1000","author":"Katz","key":"ref63"},{"article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"M\u0105dry","key":"ref64"},{"key":"ref65","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Tram\u00e8r"},{"key":"ref66","first-page":"6115","article-title":"On success and simplicity: A second look at transferable targeted attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhao"},{"article-title":"Adversarial manipulation of deep representations","volume-title":"Proc. Internation Conf. Learn. Represent.","author":"Sabour","key":"ref67"},{"key":"ref68","first-page":"306","article-title":"Who\u2019s afraid of adversarial queries? The impact of image modifications on content-based image retrieval","volume-title":"Proc. Int. Conf. Multimedia Retr.","author":"Liu"},{"key":"ref69","first-page":"1","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref70","article-title":"Revisiting transferable adversarial image examples: Attack categorization, evaluation guidelines, and new insights","author":"Zhao","year":"2023","journal-title":"arXiv:2310.11850"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2004.10934"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/1873951.1874254"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0300059"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11022751.pdf?arnumber=11022751","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,25]],"date-time":"2025-06-25T18:21:34Z","timestamp":1750875694000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11022751\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3574977","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}