{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T18:01:43Z","timestamp":1761588103320,"version":"build-2065373602"},"reference-count":99,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2021YFB3100800"],"award-info":[{"award-number":["2021YFB3100800"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation","doi-asserted-by":"publisher","award":["62376283","62531026"],"award-info":[{"award-number":["62376283","62531026"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key Stone Grant of the National University of Defense Technology","award":["JS2023-03"],"award-info":[{"award-number":["JS2023-03"]}]},{"name":"Jilin Province Science and Technology Development Projects","award":["20250102209JC"],"award-info":[{"award-number":["20250102209JC"]}]},{"name":"Special Financial Grant from China Postdoctoral Science Foundation","award":["2025T180433"],"award-info":[{"award-number":["2025T180433"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3611094","type":"journal-article","created":{"date-parts":[[2025,9,17]],"date-time":"2025-09-17T17:30:20Z","timestamp":1758130220000},"page":"11165-11180","source":"Crossref","is-referenced-by-count":0,"title":["ARBiBench: Benchmarking and Analyzing Adversarial Robustness of Binarized Convolutional Neural Networks"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4342-0139","authenticated-orcid":false,"given":"Jiehua","family":"Zhang","sequence":"first","affiliation":[{"name":"College of Electronic Science and Technology, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5434-471X","authenticated-orcid":false,"given":"Peng","family":"Zhao","sequence":"additional","affiliation":[{"name":"College of Systems Engineering, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2011-2873","authenticated-orcid":false,"given":"Li","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Electronic Science and Technology, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6793-5025","authenticated-orcid":false,"given":"Bowen","family":"Peng","sequence":"additional","affiliation":[{"name":"College of Electronic Science and Technology, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1233-1494","authenticated-orcid":false,"given":"Zhen","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Electronic Science and Technology, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0429-0263","authenticated-orcid":false,"given":"Longguang","family":"Wang","sequence":"additional","affiliation":[{"name":"Aviation University of Air Force, Changchun, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yingmei","family":"Wei","sequence":"additional","affiliation":[{"name":"College of Systems Engineering, National University of Defense Technology, Changsha, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1106","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Krizhevsky"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref3","first-page":"1","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Dosovitskiy"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i3.28034"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/tpami.2016.2577031"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-019-01247-4"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58452-8_13"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-009-0275-4"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298965"},{"key":"ref11","article-title":"Compressing deep convolutional networks using vector quantization","author":"Gong","year":"2014","journal-title":"arXiv:1412.6115"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.521"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00826"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/3DV57658.2022.00084"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.155"},{"key":"ref16","first-page":"1135","article-title":"Learning both weights and connections for efficient neural network","volume-title":"Proc. NIPS","author":"Han"},{"key":"ref17","first-page":"6379","article-title":"Global sparse momentum SGD for pruning very deep neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Ding"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1503.02531"},{"key":"ref19","first-page":"1","article-title":"Training shallow and thin networks for acceleration via knowledge distillation with conditional adversarial networks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR) Workshops","author":"Xu"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.754"},{"key":"ref21","first-page":"1269","article-title":"Exploiting linear structure within convolutional networks for efficient evaluation","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Denton"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.5244\/C.28.88"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2019.00363"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20083-0_35"},{"key":"ref25","first-page":"1","article-title":"Attacking binarized neural networks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Galloway"},{"key":"ref26","article-title":"Binarized neural networks: Training deep neural networks with weights and activations constrained to +1 or -1","author":"Courbariaux","year":"2016","journal-title":"arXiv:1602.02830"},{"article-title":"Defensive quantization: When efficiency meets robustness","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Lin","key":"ref27"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-82193-7_10"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20637"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/s44267-023-00031-w"},{"key":"ref31","article-title":"DoReFa-Net: Training low bitwidth convolutional neural networks with low bitwidth gradients","author":"Zhou","year":"2016","journal-title":"arXiv:1606.06160"},{"key":"ref32","article-title":"PACT: Parameterized clipping activation for quantized neural networks","author":"Choi","year":"2018","journal-title":"arXiv:1805.06085"},{"key":"ref33","article-title":"Learned step size quantization","author":"Esser","year":"2019","journal-title":"arXiv:1902.08153"},{"key":"ref34","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Goodfellow"},{"key":"ref35","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Szegedy"},{"key":"ref36","first-page":"1","article-title":"Combinatorial attacks on binarized neural networks","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Khalil"},{"key":"ref37","article-title":"RobustBench: A standardized adversarial robustness benchmark","author":"Croce","year":"2020","journal-title":"arXiv:2010.09670"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref39","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","volume":"97","author":"Zhang"},{"key":"ref40","first-page":"586","article-title":"Revisiting Hilbert\u2013Schmidt information bottleneck for adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"34","author":"Wang"},{"key":"ref41","first-page":"1","article-title":"Improving adversarial robustness via information bottleneck distillation","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"36","author":"Kuang"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3172986"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/JSAIT.2020.2991005"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2022.3183095"},{"key":"ref45","first-page":"4107","article-title":"Binarized neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Hubara"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_32"},{"key":"ref47","article-title":"Estimating or propagating gradients through stochastic neurons for conditional computation","author":"Bengio","year":"2013","journal-title":"arXiv:1308.3432"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3300513"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01267-0_44"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00232"},{"key":"ref51","first-page":"25553","article-title":"Learning frequency domain approximation for binary neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"34","author":"Xu"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58580-8_14"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3117908"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6900"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.01167"},{"key":"ref56","first-page":"62","article-title":"XNOR-Net++: Improved binary neural networks","volume-title":"Proc. Brit. Mach. Vis. Conf. (BMVC)","author":"Bulat"},{"key":"ref57","article-title":"Accurate and compact convolutional neural networks with trained binarization","author":"Xu","year":"2019","journal-title":"arXiv:1909.11366"},{"key":"ref58","article-title":"Training binary neural networks with real-to-binary convolutions","author":"Martinez","year":"2020","journal-title":"arXiv:2003.11535"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00515"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-021-01543-y"},{"key":"ref61","first-page":"7474","article-title":"Rotated binary neural network","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"33","author":"Lin"},{"key":"ref62","article-title":"RobustART: Benchmarking robustness on architecture design and training techniques","author":"Tang","year":"2021","journal-title":"arXiv:2109.05211"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref64","article-title":"Detecting adversarial samples from artifacts","author":"Feinman","year":"2017","journal-title":"arXiv:1703.00410"},{"key":"ref65","article-title":"Ensemble adversarial training: Attacks and defenses","author":"Tram\u00e8r","year":"2017","journal-title":"arXiv:1705.07204"},{"key":"ref66","article-title":"Certified defenses against adversarial examples","author":"Raghunathan","year":"2018","journal-title":"arXiv:1801.09344"},{"key":"ref67","first-page":"1802","article-title":"Exploring the landscape of spatial robustness","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Engstrom"},{"key":"ref68","article-title":"Functional adversarial attacks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"32","author":"Laidlaw"},{"key":"ref69","first-page":"6808","article-title":"Wasserstein adversarial examples via projected sinkhorn iterations","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Wong"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00040"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.282"},{"key":"ref72","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref74","first-page":"5032","article-title":"Adversarial risk and the dangers of evaluating against weak attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"80","author":"Uesato"},{"key":"ref75","first-page":"3866","article-title":"NATTACK: Learning the distributions of adversarial examples for an improved black-box attack on deep neural networks","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","volume":"97","author":"Li"},{"key":"ref76","first-page":"1","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Brendel"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00790"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref80","first-page":"1","article-title":"Nesterov accelerated gradient and scale invariance for adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Representations (ICLR)","author":"Lin"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref82","article-title":"A study of the effect of JPG compression on adversarial images","author":"Karolina Dziugaite","year":"2016","journal-title":"arXiv:1608.00853"},{"key":"ref83","article-title":"Feature squeezing: Detecting adversarial examples in deep neural networks","author":"Xu","year":"2017","journal-title":"arXiv:1704.01155"},{"key":"ref84","first-page":"1","article-title":"Mitigating adversarial effects through randomization","volume-title":"Proc. Int. Conf. Learn. Represent. (ICLR)","author":"Xie"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-94042-7_11"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_23"},{"key":"ref87","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"80","author":"Athalye"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1016\/j.eng.2019.12.012"},{"key":"ref89","article-title":"Benchmarking adversarial robustness of compressed deep learning models","author":"Vora","year":"2023","journal-title":"arXiv:2308.08160"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81645-2_25"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58568-6_9"},{"key":"ref92","first-page":"28351","article-title":"BiBench: Benchmarking and analyzing network binarization","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","volume":"202","author":"Qin"},{"key":"ref93","article-title":"Unrestricted adversarial examples via semantic manipulation","author":"Bhattad","year":"2019","journal-title":"arXiv:1904.06347"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72952-2_6"},{"key":"ref95","article-title":"Information plane analysis of deep neural networks via matrix-based Renyi\u2019s entropy and tensor kernels","author":"Wickstr\u00f8m","year":"2019","journal-title":"arXiv:1909.11396"},{"key":"ref96","article-title":"Opening the black box of deep neural networks via information","author":"Shwartz-Ziv","year":"2017","journal-title":"arXiv:1703.00810"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00059"},{"key":"ref98","first-page":"13931","article-title":"Revisiting adversarial training for ImageNet: Architectures, training and generalization across threat models","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","volume":"36","author":"Singh"},{"key":"ref99","article-title":"Fast is better than free: Revisiting adversarial training","author":"Wong","year":"2020","journal-title":"arXiv:2001.03994"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11168925.pdf?arnumber=11168925","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T17:56:59Z","timestamp":1761587819000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11168925\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":99,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3611094","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}