{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T16:50:29Z","timestamp":1775580629171,"version":"3.50.1"},"reference-count":70,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,1,1]],"date-time":"2022-01-01T00:00:00Z","timestamp":1640995200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["U20B2047"],"award-info":[{"award-number":["U20B2047"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62072421"],"award-info":[{"award-number":["62072421"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62002334"],"award-info":[{"award-number":["62002334"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62102386"],"award-info":[{"award-number":["62102386"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["62121002"],"award-info":[{"award-number":["62121002"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100009076","name":"Exploration Fund Project of University of Science and Technology of China","doi-asserted-by":"publisher","award":["YD3480002001"],"award-info":[{"award-number":["YD3480002001"]}],"id":[{"id":"10.13039\/501100009076","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["WK2100000011"],"award-info":[{"award-number":["WK2100000011"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["WK5290000001"],"award-info":[{"award-number":["WK5290000001"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"ECS Grant from the Research Grants Council of the Hong Kong"},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2018AAA0101400"],"award-info":[{"award-number":["2018AAA0101400"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"NSFC","doi-asserted-by":"publisher","award":["61629301"],"award-info":[{"award-number":["61629301"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2022]]},"DOI":"10.1109\/tip.2022.3201472","type":"journal-article","created":{"date-parts":[[2022,8,30]],"date-time":"2022-08-30T19:50:59Z","timestamp":1661889059000},"page":"5691-5705","source":"Crossref","is-referenced-by-count":93,"title":["Poison Ink: Robust and Invisible Backdoor Attack"],"prefix":"10.1109","volume":"31","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4230-1077","authenticated-orcid":false,"given":"Jie","family":"Zhang","sequence":"first","affiliation":[{"name":"School of Cyber Science and Security, University of Science and Technology of China, Hefei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4642-4373","authenticated-orcid":false,"given":"Chen","family":"Dongdong","sequence":"additional","affiliation":[{"name":"Microsoft Research, Redmond, WA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2702-8516","authenticated-orcid":false,"given":"Qidong","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Security, University of Science and Technology of China, Hefei, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7014-5377","authenticated-orcid":false,"given":"Jing","family":"Liao","sequence":"additional","affiliation":[{"name":"Department of Computer Science, City University of Hong, Kowloon Tong, Hong Kong"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5576-6108","authenticated-orcid":false,"given":"Weiming","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Security, University of Science and Technology of China, Hefei, China"}]},{"given":"Huamin","family":"Feng","sequence":"additional","affiliation":[{"name":"Beijing Electronic Science and Technology Institute, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9522-6157","authenticated-orcid":false,"given":"Gang","family":"Hua","sequence":"additional","affiliation":[{"name":"Wormpex AI Research LLC, Bellevue, WA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4417-9316","authenticated-orcid":false,"given":"Nenghai","family":"Yu","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Security, University of Science and Technology of China, Hefei, China"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1097","article-title":"ImageNet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst. (NIPS)","author":"Krizhevsky"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP.2013.6638947"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2015.2475625"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2017.2678168"},{"key":"ref5","first-page":"5998","article-title":"Attention is all you need","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Vaswani"},{"key":"ref6","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv:1312.6199"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2019.2940533"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3106807"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3050303"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref12","first-page":"6106","article-title":"Poison frogs! targeted clean-label poisoning attacks on neural networks","volume-title":"Proc. NeurIPs","volume":"31","author":"Shafahi"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"ref15","article-title":"Targeted backdoor attacks on deep learning systems using data poisoning","author":"Chen","year":"2017","journal-title":"arXiv:1712.05526"},{"key":"ref16","article-title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review","author":"Gao","year":"2020","journal-title":"arXiv:2007.10760"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01321"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref19","article-title":"Rethinking the trigger of backdoor attack","author":"Li","year":"2020","journal-title":"arXiv:2004.04692"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10590-1_53"},{"key":"ref21","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","author":"Geirhos","year":"2018","journal-title":"arXiv:1811.12231"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3374664.3375751"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58607-2_11"},{"key":"ref25","article-title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","author":"Li","year":"2019","journal-title":"arXiv:1909.02742"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102220"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3109602"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101916"},{"key":"ref29","first-page":"8000","article-title":"Spectral signatures in backdoor attacks","volume-title":"Proc. NeurIPs","author":"Tran"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359790"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427264"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref33","article-title":"Detecting backdoor attacks on deep neural networks by activation clustering","author":"Chen","year":"2018","journal-title":"arXiv:1811.03728"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363216"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"ref36","article-title":"TABOR: A highly accurate approach to inspecting and restoring trojan backdoors in AI systems","author":"Guo","year":"2019","journal-title":"arXiv:1908.01763"},{"key":"ref37","article-title":"Defending neural backdoors via generative distribution modeling","author":"Qiao","year":"2019","journal-title":"arXiv:1910.04749"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_14"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00038"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/tnnls.2022.3182979"},{"key":"ref41","article-title":"Exploring structure consistency for deep model watermarking","author":"Zhang","year":"2021","journal-title":"arXiv:2108.02360"},{"key":"ref42","volume-title":"Pattern Classification and Scene Analysis","volume":"3","author":"Duda","year":"1973"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.1986.4767851"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01267-0_40"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6976"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2020.3009349"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3064850"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.632"},{"key":"ref49","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2011.6033395"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.5244\/C.29.41"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.632"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.244"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2020.3009844"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.634"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.243"},{"key":"ref60","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv:1409.1556"},{"key":"ref61","first-page":"2069","article-title":"Hiding images in plain sight: Deep steganography","volume-title":"Proc. NeurIPs","author":"Baluja"},{"key":"ref62","article-title":"WaNet\u2014Imperceptible warping-based backdoor attack","author":"Nguyen","year":"2021","journal-title":"arXiv:2102.10369"},{"key":"ref63","article-title":"Backdoor attack through frequency domain","author":"Wang","year":"2021","journal-title":"arXiv:2111.10991"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464809"},{"key":"ref65","first-page":"1633","article-title":"On adaptive attacks to adversarial example defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Tramer"},{"key":"ref66","article-title":"On evaluating adversarial robustness","author":"Carlini","year":"2019","journal-title":"arXiv:1902.06705"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9414862"},{"key":"ref68","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref69","volume-title":"What doesn\u2019t kill you makes you robust(er): How to adversarially train against data poisoning","author":"Geiping","year":"2022"},{"key":"ref70","article-title":"Invisible backdoor attack with sample-specific triggers","author":"Li","year":"2020","journal-title":"arXiv:2012.03816"}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/83\/9626658\/09870671.pdf?arnumber=9870671","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T12:28:26Z","timestamp":1706790506000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9870671\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022]]},"references-count":70,"URL":"https:\/\/doi.org\/10.1109\/tip.2022.3201472","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022]]}}}