{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T11:26:54Z","timestamp":1783078014985,"version":"3.54.6"},"reference-count":48,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,1,1]],"date-time":"2023-01-01T00:00:00Z","timestamp":1672531200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"CityU APRC","award":["9610614"],"award-info":[{"award-number":["9610614"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. on Image Process."],"published-print":{"date-parts":[[2023]]},"DOI":"10.1109\/tip.2023.3326398","type":"journal-article","created":{"date-parts":[[2023,10,26]],"date-time":"2023-10-26T18:12:39Z","timestamp":1698343959000},"page":"6102-6114","source":"Crossref","is-referenced-by-count":35,"title":["Fast Adversarial Training With Adaptive Step Size"],"prefix":"10.1109","volume":"32","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5012-0981","authenticated-orcid":false,"given":"Zhichao","family":"Huang","sequence":"first","affiliation":[{"name":"Tencent AI Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8530-485X","authenticated-orcid":false,"given":"Yanbo","family":"Fan","sequence":"additional","affiliation":[{"name":"Tencent AI Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9585-3991","authenticated-orcid":false,"given":"Chen","family":"Liu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, City University of Hong Kong, Kowloon Tong, Hong Kong"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Weizhong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Data Science, Fudan University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0066-3448","authenticated-orcid":false,"given":"Yong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tencent AI Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8347-8637","authenticated-orcid":false,"given":"Mathieu","family":"Salzmann","sequence":"additional","affiliation":[{"name":"School of Computer and Communication Sciences, École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0441-6068","authenticated-orcid":false,"given":"Sabine","family":"S\u00fcsstrunk","sequence":"additional","affiliation":[{"name":"School of Computer and Communication Sciences, École Polytechnique Fédérale de Lausanne (EPFL), Lausanne, Switzerland"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3641-3136","authenticated-orcid":false,"given":"Jue","family":"Wang","sequence":"additional","affiliation":[{"name":"Tencent AI Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Szegedy"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3127849"},{"key":"ref3","first-page":"1","article-title":"Countering adversarial images using input transformations","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Guo"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2019.2940533"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3092582"},{"key":"ref7","first-page":"1","article-title":"Towards deep learning models resistant to adversarial attacks","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Madry"},{"key":"ref8","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2021.3082317"},{"key":"ref10","first-page":"1","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wang"},{"key":"ref11","first-page":"8093","article-title":"Overfitting in adversarially robust deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Rice"},{"key":"ref12","first-page":"1","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Wong"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00126"},{"key":"ref14","first-page":"16048","article-title":"Understanding and improving fast adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Andriushchenko"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i9.16989"},{"key":"ref16","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref18","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref19","first-page":"1","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Goodfellow"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref21","first-page":"2196","article-title":"Minimally distorted adversarial examples with a fast adaptive boundary attack","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref22","first-page":"1","article-title":"Pixeldefend: Leveraging generative models to understand and defend against adversarial examples","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Song"},{"key":"ref23","article-title":"Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets","author":"Balaji","year":"2019","journal-title":"arXiv:1910.08051"},{"key":"ref24","first-page":"20297","article-title":"Guided adversarial attack for evaluating and enhancing adversarial defenses","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"33","author":"Sriramanan"},{"key":"ref25","doi-asserted-by":"crossref","DOI":"10.1137\/1.9781611971132","volume-title":"Dynamic Noncooperative Game Theory","author":"Basar","year":"1998"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1785414.1785439"},{"key":"ref27","first-page":"1497","article-title":"A unified analysis of extra-gradient and optimistic gradient methods for saddle point problems: Proximal point approach","volume-title":"Proc. Int. Conf. Artif. Intell. Statist.","author":"Mokhtari"},{"key":"ref28","first-page":"6083","article-title":"On gradient descent ascent for nonconvex-concave minimax problems","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Lin"},{"key":"ref29","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Wong"},{"key":"ref30","first-page":"1","article-title":"Adversarial training for free!","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Shafahi"},{"key":"ref31","first-page":"1","article-title":"You only propagate once: Accelerating adversarial training via maximal principle","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Zhang"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01305"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2022.3184255"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00766"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19772-7_33"},{"key":"ref36","first-page":"11821","article-title":"Towards efficient and effective adversarial training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"34","author":"Sriramanan"},{"issue":"7","key":"ref37","first-page":"2121","article-title":"Adaptive subgradient methods for online learning and stochastic optimization","volume":"12","author":"Duchi","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref38","article-title":"Rmsprop: Divide the gradient by a running average of its recent magnitude","author":"Tieleman","year":"2012","journal-title":"COURSERA, Neural Netw. Mach. Learn."},{"key":"ref39","article-title":"Convergence analyses of online Adam algorithm in convex setting and two-layer ReLU neural network","author":"Fang","year":"2019","journal-title":"arXiv:1905.09356"},{"key":"ref40","first-page":"1","article-title":"Adam: A method for stochastic optimization","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Kingma"},{"key":"ref41","first-page":"1","article-title":"On the convergence of Adam and beyond","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Reddi"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/95"},{"key":"ref43","first-page":"1","article-title":"MMA training: Direct input space margin maximization through adversarial training","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Ding"},{"key":"ref44","first-page":"11492","article-title":"To be robust or to be fair: Towards fairness in adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xu"},{"key":"ref45","article-title":"On the impact of hard adversarial instances on overfitting in adversarial training","author":"Liu","year":"2021","journal-title":"arXiv:2112.07324"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref47","article-title":"CorrAttack: Black-box adversarial attack with structured search","author":"Huang","year":"2020","journal-title":"arXiv:2010.01250"},{"key":"ref48","first-page":"1","article-title":"Prior convictions: Black-box adversarial attacks with bandits and priors","volume-title":"Proc. Int. Conf. Learn. Represent.","author":"Ilyas"}],"container-title":["IEEE Transactions on Image Processing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/83\/9991910\/10298035.pdf?arnumber=10298035","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,12]],"date-time":"2024-01-12T01:16:25Z","timestamp":1705022185000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10298035\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023]]},"references-count":48,"URL":"https:\/\/doi.org\/10.1109\/tip.2023.3326398","relation":{},"ISSN":["1057-7149","1941-0042"],"issn-type":[{"value":"1057-7149","type":"print"},{"value":"1941-0042","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023]]}}}