{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,15]],"date-time":"2026-04-15T00:31:14Z","timestamp":1776213074292,"version":"3.50.1"},"reference-count":72,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"9","license":[{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,9,1]],"date-time":"2025-09-01T00:00:00Z","timestamp":1756684800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2024YFB3108100"],"award-info":[{"award-number":["2024YFB3108100"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476250"],"award-info":[{"award-number":["62476250"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472335"],"award-info":[{"award-number":["62472335"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372137"],"award-info":[{"award-number":["62372137"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U21A20463"],"award-info":[{"award-number":["U21A20463"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U244120033"],"award-info":[{"award-number":["U244120033"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U24A20336"],"award-info":[{"award-number":["U24A20336"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Knowl. Data Eng."],"published-print":{"date-parts":[[2025,9]]},"DOI":"10.1109\/tkde.2025.3580116","type":"journal-article","created":{"date-parts":[[2025,6,16]],"date-time":"2025-06-16T15:01:10Z","timestamp":1750086070000},"page":"5201-5213","source":"Crossref","is-referenced-by-count":7,"title":["F2AT: Feature-Focusing Adversarial Training via Disentanglement of Natural and Perturbed Patterns"],"prefix":"10.1109","volume":"37","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4056-9755","authenticated-orcid":false,"given":"Yaguan","family":"Qian","sequence":"first","affiliation":[{"name":"School of Artificial Intelligence and Information Engineering, Zhejiang University of Science and Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-2444-9908","authenticated-orcid":false,"given":"Chenyu","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Science, Zhejiang University of Science and Technology, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen), Shenzhen, China"}]},{"given":"Bin","family":"Wang","sequence":"additional","affiliation":[{"name":"Zhejiang Key Laboratory of Multidimensional Perception Technology, Application and Cybersecurity, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4268-372X","authenticated-orcid":false,"given":"Shouling","family":"Ji","sequence":"additional","affiliation":[{"name":"School of Computer Science and Technology, Zhejiang University, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5974-1589","authenticated-orcid":false,"given":"Wei","family":"Wang","sequence":"additional","affiliation":[{"name":"Ministry of Education Key Lab for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5094-5980","authenticated-orcid":false,"given":"Yanchun","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Mathematics, Victoria University, Melbourne, VIC, Australia"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Very deep convolutional networks for large-scale image recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Simonyan"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P18-1008"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3178115"},{"key":"ref4","article-title":"Keeping the bad guys out: Protecting and vaccinating deep learning with JPEG compression","author":"Das","year":"2017","journal-title":"arXiv: 1705.02900"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref6","article-title":"Stochastic activation pruning for robust adversarial defense","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Dhillon"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3244994"},{"key":"ref8","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Goodfellow"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2024.129124"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.patrec.2023.07.009"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/591"},{"key":"ref13","first-page":"1383","article-title":"Concise explanations of neural networks using adversarial training","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Chalasani"},{"key":"ref14","article-title":"ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Geirhos"},{"key":"ref15","article-title":"Noise or signal: The role of image backgrounds in object recognition","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xiao"},{"key":"ref16","first-page":"38761","article-title":"Explicit tradeoffs between adversarial and natural distributional robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Moayeri"},{"key":"ref17","first-page":"125","article-title":"Adversarial examples are not bugs, they are features","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ilyas"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939778"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727230"},{"key":"ref20","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhang"},{"key":"ref21","article-title":"Improving adversarial robustness requires revisiting misclassified examples","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref22","first-page":"2958","article-title":"Adversarial weight perturbation helps robust generalization","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Wu"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00035"},{"key":"ref24","article-title":"Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets","author":"Balaji","year":"2019","journal-title":"arXiv: 1910.08051"},{"key":"ref25","article-title":"Intriguing properties of neural networks","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Szegedy"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref27","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Croce"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3293959"},{"key":"ref30","first-page":"321","article-title":"Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Demontis"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00483"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3430508"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3502693"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3239746"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3078755"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2021.3130903"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2851247"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00191"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134057"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref41","article-title":"Adversarial logit pairing","author":"Kannan","year":"2018","journal-title":"arXiv: 1803.06373"},{"key":"ref42","first-page":"478","article-title":"Metric learning for adversarial robustness","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Mao"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00665"},{"key":"ref44","article-title":"Adversarial machine learning at scale","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kurakin"},{"key":"ref45","article-title":"Self-ensemble adversarial training for improved robustness","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Wang"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511606267"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1038\/23703"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1523\/JNEUROSCI.5766-08.2009"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CSSE.2008.270"},{"key":"ref50","first-page":"27338","article-title":"Improving adversarial robustness via mutual information estimation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Zhou"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1162\/089976603321780272"},{"key":"ref52","article-title":"On the geometry of adversarial examples","author":"Khoury","year":"2018","journal-title":"arXiv: 1811.00525"},{"key":"ref53","article-title":"Towards understanding adversarial examples systematically: Exploring data size, task and model factors","author":"Sun","year":"2019","journal-title":"arXiv: 1902.11019"},{"key":"ref54","first-page":"1624","article-title":"Robustness of classifiers: From adversarial to random noise","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Fawzi"},{"issue":"4","key":"ref55","article-title":"Learning multiple layers of features from tiny images","volume":"1","author":"Krizhevsky","year":"2009","journal-title":"Handbook Systemic Autoimmune Dis."},{"key":"ref56","article-title":"Tiny-ImageNet visual recognition challenge","author":"Kuang","year":"2015"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.5244\/C.30.87"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00284"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00196"},{"key":"ref63","first-page":"2484","article-title":"Simple black-box adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref64","article-title":"Sign-OPT: A query-efficient hard-label adversarial attack","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Cheng"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-58592-1_29"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00045"},{"key":"ref67","article-title":"Bag of tricks for adversarial training","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Pang"},{"key":"ref68","first-page":"6840","article-title":"Denoising diffusion probabilistic models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Ho"},{"key":"ref69","first-page":"17258","article-title":"Robustness and accuracy could be reconcilable by (proper) definition","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Pang"},{"key":"ref70","article-title":"Exploring and exploiting decision boundary dynamics for adversarial robustness","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Xu"},{"key":"ref71","article-title":"Fixing data augmentation to improve adversarial robustness","author":"Rebuffi","year":"2021","journal-title":"arXiv:2103.01946"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"}],"container-title":["IEEE Transactions on Knowledge and Data Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/69\/11119623\/11037479.pdf?arnumber=11037479","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,11]],"date-time":"2025-08-11T20:50:11Z","timestamp":1754945411000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11037479\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,9]]},"references-count":72,"journal-issue":{"issue":"9"},"URL":"https:\/\/doi.org\/10.1109\/tkde.2025.3580116","relation":{},"ISSN":["1041-4347","1558-2191","2326-3865"],"issn-type":[{"value":"1041-4347","type":"print"},{"value":"1558-2191","type":"electronic"},{"value":"2326-3865","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,9]]}}}